VULNERABILITY INTELLIGENCE

CVE-2022-39135

CVSS score9.8 CRITICAL

EPSS probability2.20%

CISA KEVNot currently listed

Published2022-09-11

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this vulnerability (the extent of it will depend on the user under which the application is running). From Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled on the impacted operators.

Weakness classification

security@apache.org: CWE-611
nvd@nist.gov: CWE-611

Primary references

security@apache.org — Mailing List, Mitigation, Third Party Advisory
security@apache.org — Mailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Vendor Advisory