CVE-2022-4245
25.09.2023, 20:15
A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.
| Vendor | Product | Version |
|---|---|---|
| codehaus-plexus | plexus-utils | 𝑥 < 3.0.24 |
| redhat | integration_camel_k | 𝑥 < 1.10.1 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-91 - XML Injection (aka Blind XPath Injection)The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
- CWE-611 - Improper Restriction of XML External Entity ReferenceThe software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
References