codehaus-plexus vulnerable to XML injection

MEDIO 4.3CVE-2022-4245 · GHSA-jcwr-x25h-x5fh · Published 25/09/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
org.codehaus.plexus:plexus-utils Maven	`< 3.0.24`	`3.0.24`
plexus-utils codehaus-plexus	`< 3.0.24`	`3.0.24`
integration camel k redhat	`< 1.10.1`	`1.10.1`

Description

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.

NVD description

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.

References

nvd.nist.gov/vuln/detail/CVE-2022-4245 · ADVISORY
codehaus-plexus/plexus-utils · WEB
codehaus-plexus/plexus-utils commit f933e5e · WEB
access.redhat.com/errata/RHSA-2023:2135 · WEB
access.redhat.com/errata/RHSA-2023:3906 · WEB
access.redhat.com/security/cve/CVE-2022-4245 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
codehaus-plexus/plexus-utils · PACKAGE
security.snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-461102 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free