Medium severity · published May 21, 2025
CVE-2025-4949
XXE vulnerability in Eclipse JGit
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EJ
Eclipse JGit · Eclipse JGit
7.2.0 before 7.2.1.202505142326-r; 7.1.0 before 7.1.1.202505221757-r; 7.0.0 before 7.0.1.202505221510-r; before 5.13.4.202507202350-r; 6.0.0 before 6.10.1.202505221210-r; 7.2.0 before 7.2.1.202505142326-r; +4 more · source: vendor
JG
Jgit · Eclipse
before 5.13.4; 6.0.0 before 6.10.1.202505221210; 7.0.0 before 7.0.1.202505221510; 7.1.0 before 7.1.1.202505221757; 7.2.0 before 7.2.1.202505142326 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-4949
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-4949
Issue Tracking
https://gitlab.eclipse.org/security/cve-assignement/-/issues/64
Exploit
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281
Release Notes
https://projects.eclipse.org/projects/technology.jgit/releases/5.13.4
Release Notes
https://projects.eclipse.org/projects/technology.jgit/releases/6.10.1
Release Notes
https://projects.eclipse.org/projects/technology.jgit/releases/7.0.1
Release Notes
https://projects.eclipse.org/projects/technology.jgit/releases/7.1.1