codehaus-plexus vulnerable to XML injection

中 4.3CVE-2022-4245 · GHSA-jcwr-x25h-x5fh · 25/09/2023 公開 · 17/06/2026 更新

要点

CVE-2022-4245 は org.codehaus.plexus:plexus-utils, plexus-utils (codehaus-plexus), integration camel k (redhat) に影響する深刻度「中」 (CVSS 4.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.69%（全脆弱性の 53.0% より高い）。
対処：3.0.24, 1.10.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.codehaus.plexus:plexus-utils Maven	`< 3.0.24`	`3.0.24`
plexus-utils codehaus-plexus	`< 3.0.24`	`3.0.24`
integration camel k redhat	`< 1.10.1`	`1.10.1`

概要

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.

NVD の説明

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.