CVE-2022-4245: Codehaus-plexus: xml external entity (xxe) injection
A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.
Other sources
A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.
— MITRE
org.codehaus.plexus:plexus-utils is a collection of various utility classes to ease working with strings, files, command lines, XML and more.
Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This means that text contained in the command string could be interpreted as XML and allow for XML injection.
https://security.snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-461102
— Red Hat
Plexus-Utils could allow a remote authenticated attacker to obtain sensitive information, caused by an XML injection vulnerability in the XmlWriterUtil.java script. By sending a specially-crafted request to XMLWriter using a "-->" sequence, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-4245?
CVE-2022-4245 is a vulnerability found in codehaus-plexus that allows for XML injection.
How does CVE-2022-4245 affect codehaus-plexus?
CVE-2022-4245 affects codehaus-plexus by failing to sanitize comments for a `-->` sequence, allowing for potential XML injection.
What is the severity of CVE-2022-4245?
The severity of CVE-2022-4245 is medium (CVSS score of 4).
How can I fix CVE-2022-4245?
To fix CVE-2022-4245, update codehaus-plexus to version 3.0.24 or higher.
Where can I find more information about CVE-2022-4245?
You can find more information about CVE-2022-4245 at the following references: [Link 1](https://security.snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-461102), [Link 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2157638), [Link 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2157639).