CVE-2022-2838CWE-611

In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection…

published August 16, 2022

CVSS
—
EPSS
1%
Percentile
45.1
In the wild
Unconfirmed
What it is

In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection of arbitrary definitions which is able to access local files and expose their contents via HTTP requests.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00547 · 45.1th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2022-08-16T10:10Z
EPSS history
Timeline
  • 16 AUG 10:10Z
    In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection…
    cvelistv5