Improper Restriction of XML External Entity Reference in Liquibase

CRÍTICO 9.8CVE-2022-0839 · GHSA-jvfv-hrrc-6q72 · Published 04/03/2022 · updated 17/06/2026

En resumen

CVE-2022-0839 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a org.liquibase:liquibase-core, liquibase (liquibase), sqlcl (oracle).
Probabilidad de explotación en los próximos 30 días (EPSS): 3.0%, mayor que el 87.3% de las vulnerabilidades.
Solución: actualizar a 4.8.0 o posterior.

Package	Affected versions	Patched versions
org.liquibase:liquibase-core Maven	`< 4.8.0`	`4.8.0`
liquibase liquibase	`< 4.8.0`	`4.8.0`
sqlcl oracle	`= 19c`	No fix yet

Description

The XMLChangeLogSAXParser() function in Liquibase prior to version 4.8.0 contains an issue that may lead to to Improper Restriction of XML External Entity Reference.

NVD description

Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.

References

nvd.nist.gov/vuln/detail/CVE-2022-0839 · ADVISORY
liquibase/liquibase commit 33d9d92 · WEB
liquibase/liquibase · PACKAGE
huntr.dev/bounties/f1ae5779-b406-4594-a8a3-d089c68d6e70 · WEB
oracle.com/security-alerts/cpujul2022.html · WEB
seclists.org/fulldisclosure/2025/Apr/14 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free