VULNERABILITY INTELLIGENCE

CVE-2022-4245

CVSS score4.3 MEDIUM
EPSS probability0.69%
CISA KEVNot currently listed
Published2023-09-25
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.

Weakness classification

  • CWE-91: XML Injection (aka Blind XPath Injection)
  • CWE-611: Improper Restriction of XML External Entity Reference

Primary references