Description
A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4Attack Vector: Network
Complexity: Low
Privileges: Low
User Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None
Affected Packages4 packages
🔴Vulnerability Details
4OSVCVE-2022-4245: A flaw was found in codehaus-plexus↗2023-09-25 OSVcodehaus-plexus vulnerable to XML injection↗2023-09-25 CVEListCodehaus-plexus: xml external entity (xxe) injection↗2023-09-25 GHSAcodehaus-plexus vulnerable to XML injection↗2023-09-25 📋Vendor Advisories
2Red Hatcodehaus-plexus: XML External Entity (XXE) Injection↗2022-12-01 DebianCVE-2022-4245: plexus-utils2 - A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterU...↗2022