CVE-2022-34169

Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

High · published July 19, 2022

Patch now

High probability of exploitation

CVSS calls it high at 7.5. It sits in the 99.6th percentile for exploit probability.

CVSS v3.1

7.5

EPSS

82%

Percentile

99.6

In the wild

Unconfirmed

What it is

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.81759 · 99.6th percentile
Published: 2022-07-19T00:00Z

EPSS history

Timeline

19 JUL 00:00Z
Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
cvelistv5