Vulnerability · Published Nov 21, 2022 · Assigned by apache
CVE-2022-45470Apache Hama allows XSS and information disclosure
High 7.5
In plain English
A high-severity improper input validation in Apache Hama from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.4%top 28.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
missing input validation in Apache Hama may cause information disclosure through path traversal and XSS. Since Apache Hama is EOL, we do not expect these issues to be fixed.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.hama:hama-core | no fix listed | GHSA-4wfh-48v4-3r84 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Hama | 1.7.1 – before Apache Hama* |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N