CVE-2022-2838 Vulnerability Details

  /     /     /  

CVE-2022-2838 Metadata Quick Info

CVE Published: 16/08/2022 | CVE Updated: 03/08/2024 | CVE Year: 2022
Source: eclipse | Vendor: The Eclipse Foundation | Product: Eclipse Sphinx
Status : PUBLISHED

---

CVE-2022-2838 Description

In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection of arbitrary definitions which is able to access local files and expose their contents via HTTP requests.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-611
CWE Name: CWE-611: Improper Restriction of XML External Entity Reference
Source: The Eclipse Foundation

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).