CVE-2022-23437 — Infinite Loop in Software Foundation Apache Xerces

CWE-835 — Infinite LoopCWE-91 — XML Injection (aka Blind XPath Injection)17 documents7 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 75.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
30
Oracle Communications Element ManagerOracle Communications Session Report ManagerOracle Communications Session Route Manager+27 more
Timeline
PublishedJan 24
Latest updateOct 15

Description

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages30 packages

▶NVDapache/xerces-j2.12.1
▶CVEListV5apache_software_foundation/apache_xercesApache XercesJ — 2.12.1
▶RubyGemsnokogiri/nokogiri< 1.13.4

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

7
OSV
pillow vulnerability↗2022-10-24
▶
GHSA
XML Injection in Xerces Java affects Nokogiri↗2022-04-11
▶
OSV
XML Injection in Xerces Java affects Nokogiri↗2022-04-11
▶
OSV
Infinite Loop in Apache Xerces Java↗2022-01-27
▶
GHSA
Infinite Loop in Apache Xerces Java↗2022-01-27
▶

📋Vendor Advisories

9
Oracle
Oracle Oracle Communications Risk Matrix: Web UI (Apache Xerces2 Java) — CVE-2022-23437↗2024-10-15
▶
Oracle
Oracle Oracle Commerce Risk Matrix: Endeca Application Controller (Apache Xerces2 Java) — CVE-2022-23437↗2023-07-15
▶
Oracle
Oracle Oracle Commerce Risk Matrix: Content Acquisition System, Workbench (Apache Xerces2 Java) — CVE-2022-23437↗2023-04-15
▶
Oracle
Oracle Oracle Insurance Applications Risk Matrix: Development Tools (Apache Xerces-J) — CVE-2022-23437↗2023-01-15
▶
Oracle
Oracle Oracle Commerce Risk Matrix: Endeca Integration (Apache Xerces-J) — CVE-2022-23437↗2022-10-15
▶
CVE-2022-23437 — Infinite Loop | cvebase