XML External Entity (XXE) Injection Affecting org.codehaus.plexus:plexus-utils package, versions [,3.0.24)
Threat Intelligence
EPSS
0.34% (73rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGCODEHAUSPLEXUS-461102
- published 6 Sep 2019
- disclosed 21 Sep 2015
- credit Florian Weimer
Introduced: 21 Sep 2015
CVE-2022-4245 Open this link in a new tabHow to fix?
Upgrade org.codehaus.plexus:plexus-utils to version 3.0.24 or higher.
Overview
org.codehaus.plexus:plexus-utils is a collection of various utility classes to ease working with strings, files, command lines, XML and more.
Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This means that text contained in the command string could be interpreted as XML and allow for XML injection.
References
CVSS Scores
version 3.1