CVE-2022-25312

CRITICAL

Apache Any23 < 2.7 - XML External Entity Injection in RDFa XSLTStylesheet Extractor

Title source: llm

Description

An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Any23 2.7.

References (2)

Core 2

Core References

Mailing List, Vendor Advisory x_refsource_misc

https://lists.apache.org/thread/y6cm5n3ksohsrhzqknqhzy7p3mtkyk23

Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2022/03/04/2

Scores

CVSS v3 9.1

EPSS 0.0127

EPSS Percentile 79.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE

CWE-611

Status published

Products (2)

apache/any23 < 2.7

org.apache.any23/apache-any23 0 - 2.7Maven

Published Mar 05, 2022

Tracked Since Feb 18, 2026