CVE-2022-4245: medium-severity vulnerability in Red Hat A-MQ Clients 2
Codehaus-plexus: xml external entity (xxe) injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3epss 0.7%
A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
Red Hat · A-MQ Clients 2Red Hat · Red Hat A-MQ OnlineRed Hat · Red Hat build of Apache Camel for Spring BootRed Hat · Red Hat build of QuarkusRed Hat · Red Hat Data Grid 8Red Hat · Red Hat Decision Manager 7Red Hat · Red Hat Enterprise Linux 7Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat Integration Camel QuarkusRed Hat · Red Hat Integration Change Data CaptureRed Hat · Red Hat Integration Service RegistryRed Hat · Red Hat JBoss A-MQ 7Red Hat · Red Hat JBoss Data Grid 7Red Hat · Red Hat JBoss Enterprise Application Platform 6Red Hat · Red Hat JBoss Enterprise Application Platform 7Red Hat · Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat · Red Hat JBoss Fuse 6Red Hat · Red Hat JBoss Fuse 7Red Hat · Red Hat JBoss Fuse Service Works 6Red Hat · Red Hat JBoss Web Server 3Red Hat · Red Hat JBoss Web Server 5Red Hat · Red Hat OpenShift Application RuntimesRed Hat · Red Hat Process Automation 7Red Hat · Red Hat Single Sign-On 7Red Hat · Red Hat Software CollectionsRed Hat · Red Hat support for Spring BootRed Hat · RHINT Camel-K-1.10.1Red Hat · RHPAM 7.13.1 asyncRelated CVEs — Red Hat A-MQ Clients 2
In the same product, most dangerous first.
CVE-2024-1023MEDIUMIo.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertxEPSS 1.7%CVE-2022-4244HIGHCodehaus-plexus: directory traversalEPSS 1.3%CVE-2024-1300MEDIUMIo.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni supportEPSS 1.1%CVE-2022-1415HIGHDrools: unsafe data deserialization in streamutilsEPSS 1.0%CVE-2023-1932MEDIUMHibernate-validator: rendering of invalid html with safehtml leads to html injection and xssEPSS 0.5%CVE-2023-5675MEDIUMQuarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.EPSS 0.5%