Vulnerability · Published Oct 6, 2022 · Assigned by apache
CVE-2022-40160Stack Overflow in JXPath
Unrated
In plain English
A stack buffer overflow in jxpath from jxpath. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).
Severity (CVSS )–Not rated
Exploit odds (30 days)1.4%top 26.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is intended to be used and failed to contact the JXPath maintainers prior to requesting the CVE allocation. The CVE was then allocated by Google in breach of the CNA rules. After review by the JXPath maintainers, the original report was found to be invalid.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | commons-jxpath:commons-jxpath | no fix listed | GHSA-mqxp-cjr9-c5jm |
Affected products (as reported)
Weakness: CWE-121