CVE-2022-28890

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.

Score

CVSS 3.1 9.8 Critical

Status

Modified - security@apache.org

Published

2022-05-05

Last modified

2024-08-03

Weaknesses

CWE-611

Affected products

• Jena (Apache)
• Apache Jena (Apache Software Foundation)

References

• https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878