Vulnerability · Published Aug 16, 2022 · Assigned by eclipse
CVE-2022-2838
Medium 5.3
In plain English
A medium-severity XML external entity in Eclipse Sphinx from The Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)0.6%top 53.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection of arbitrary definitions which is able to access local files and expose their contents via HTTP requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Eclipse Foundation | Eclipse Sphinx | 0.7.0 – before unspecifiedunspecified – before 0.13.1 |
Weakness: CWE-611
References
- https://bugs.eclipse.org/580542 x_refsource_CONFIRM