CVE-2022-25312: fallo en Apache Any23
An XML external entity (XXE) injection vulnerability exists in the Apache Any23 RDFa XSLTStylesheet extractor
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 2.9%
An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Any23 2.7.
Productos afectados
Apache Software Foundation · Apache Any23CVEs relacionadas — Apache Any23
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-40146—A Remote Code Execution (RCE) vulnerability exists in Apache Any23 YAMLExtractor.javaEPSS 5.7%CVE-2021-38555—An XML external entity (XXE) injection vulnerability exists in Apache Any23 StreamUtils.javaEPSS 2.8%CVE-2023-34150MEDIUMApache Any23: Possible excessive allocation of resources reading input.EPSS 1.5%