CVE-2022-4245CWE-91

Codehaus-plexus: xml external entity (xxe) injection

Medium · published September 25, 2023

CVSS v3.1
4.3
EPSS
1%
Percentile
52.4
In the wild
Unconfirmed
What it is

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00694 · 52.4th percentile
Weakness
CWE-91 · XML Injection (aka Blind XPath Injection)
Published
2023-09-25T19:20Z
EPSS history
Timeline
  • 25 SEP 19:20Z
    Codehaus-plexus: xml external entity (xxe) injection
    cvelistv5