Vulnerability · Published Sep 25, 2023 · Assigned by redhat

CVE-2022-4245Codehaus-plexus: xml external entity (xxe) injection

Medium 4.3

In plain English

A medium-severity security flaw in A-MQ Clients 2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.7%top 46.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	plexus-utils2	3.0.24-1	DEBIAN-CVE-2022-4245
Debian:13	plexus-utils2	3.0.24-1	DEBIAN-CVE-2022-4245
Debian:14	plexus-utils2	3.0.24-1	DEBIAN-CVE-2022-4245
Maven	org.codehaus.plexus:plexus-utils	3.0.24	GHSA-jcwr-x25h-x5fh

Affected products (as reported)

Vendor	Product	Versions
Red Hat	RHINT Camel-K-1.10.1	see references
Red Hat	RHPAM 7.13.1 async	see references
Red Hat	A-MQ Clients 2	see references
Red Hat	Red Hat A-MQ Online	see references
Red Hat	Red Hat build of Apache Camel for Spring Boot	see references
Red Hat	Red Hat build of Quarkus	see references
Red Hat	Red Hat Data Grid 8	see references
Red Hat	Red Hat Decision Manager 7	see references
Red Hat	Red Hat Enterprise Linux 7	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Integration Camel Quarkus	see references
Red Hat	Red Hat Integration Change Data Capture	see references
Red Hat	Red Hat Integration Service Registry	see references
Red Hat	Red Hat JBoss A-MQ 7	see references
Red Hat	Red Hat JBoss Data Grid 7	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 6	see references
Red Hat	Red Hat JBoss Enterprise Application Platform 7	see references
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	see references
Red Hat	Red Hat JBoss Fuse 6	see references
Red Hat	Red Hat JBoss Fuse 7	see references
Red Hat	Red Hat JBoss Fuse Service Works 6	see references
Red Hat	Red Hat JBoss Web Server 3	see references
Red Hat	Red Hat JBoss Web Server 5	see references
Red Hat	Red Hat OpenShift Application Runtimes	see references
Red Hat	Red Hat Process Automation 7	see references
Red Hat	Red Hat Single Sign-On 7	see references
Red Hat	Red Hat Software Collections	see references

Weakness: CWE-91 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

RHSA-2023:2135 vendor-advisory, x_refsource_REDHAT
RHSA-2023:3906 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2022-4245 vdb-entry, x_refsource_REDHAT
RHBZ#2149843 issue-tracking, x_refsource_REDHAT