CVE-2022-4245
A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.
- Score
- CVSS 3.1 4.3 Medium
- Status
- Modified - secalert@redhat.com
- Published
- 2023-09-25
- Last modified
- 2024-08-03
- Weaknesses
- CWE-611, CWE-91
Affected products
- Plexus-utils (Codehaus-plexus)
- A Mq Clients (Redhat)
- Amq Broker (Redhat)
- Amq Online (Redhat)
- Camel K (Redhat)
- Camel Quarkus (Redhat)
- Camel Spring Boot (Redhat)
- Enterprise Linux (Redhat)
- Integration (Redhat)
- Integration Camel K (Redhat)
- Jboss Data Grid (Redhat)
- Jboss Enterprise Application Platform (Redhat)
- Jboss Enterprise Bpms Platform (Redhat)
- Jboss Enterprise Brms Platform (Redhat)
- Jboss Enterprise Web Server (Redhat)
- Jboss Fuse (Redhat)
- Jboss Fuse Service Works (Redhat)
- Jbosseapxp (Redhat)
- Openshift Application Runtimes (Redhat)
- Quarkus (Redhat)
- Red Hat Single Sign On (Redhat)
- Rhel Software Collections (Redhat)
- Service Registry (Redhat)
References
- https://access.redhat.com/errata/RHSA-2023:2135
- https://access.redhat.com/errata/RHSA-2023:3906
- https://access.redhat.com/security/cve/CVE-2022-4245
- https://bugzilla.redhat.com/show_bug.cgi?id=2149843
