Vulnerability Description
An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Any23 2.7.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Any23 | < 2.7 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2022/03/04/2Mailing ListPatchThird Party Advisory
- https://lists.apache.org/thread/y6cm5n3ksohsrhzqknqhzy7p3mtkyk23Mailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2022/03/04/2Mailing ListPatchThird Party Advisory
- https://lists.apache.org/thread/y6cm5n3ksohsrhzqknqhzy7p3mtkyk23Mailing ListVendor Advisory
FAQ
What is CVE-2022-25312?
CVE-2022-25312 is a vulnerability with a CVSS score of 9.1 (CRITICAL). An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML external entity injection (also known as...
How severe is CVE-2022-25312?
CVE-2022-25312 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-25312?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Any23.