CVE-2022-4245 Codehaus-plexus: xml external entity (xxe) injection
A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.
Problem types: cwe_id: CWE-91
description: XML Injection (aka Blind XPath Injection)
Affected products: vendor: Red Hat
product: RHINT Camel-K-1.10.1
cpes: cpe:/a:redhat:camel_k:1
default_status: unaffected
vendor: Red Hat
product: RHPAM 7.13.1 async
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13
default_status: unaffected
vendor: Red Hat
product: A-MQ Clients 2
cpes: cpe:/a:redhat:a_mq_clients:2
default_status: affected
vendor: Red Hat
product: Red Hat A-MQ Online
cpes: cpe:/a:redhat:amq_online:1
default_status: affected
vendor: Red Hat
product: Red Hat build of Apache Camel for Spring Boot
cpes: cpe:/a:redhat:camel_spring_boot:3
default_status: affected
vendor: Red Hat
product: Red Hat build of Quarkus
cpes: cpe:/a:redhat:quarkus:2
default_status: affected
vendor: Red Hat
product: Red Hat Data Grid 8
cpes: cpe:/a:redhat:jboss_data_grid:8
default_status: affected
vendor: Red Hat
product: Red Hat Decision Manager 7
cpes: cpe:/a:redhat:jboss_enterprise_brms_platform:7
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: unaffected
vendor: Red Hat
product: Red Hat Integration Camel Quarkus
cpes: cpe:/a:redhat:camel_quarkus:2
default_status: affected
vendor: Red Hat
product: Red Hat Integration Change Data Capture
cpes: cpe:/a:redhat:integration:1
default_status: affected
vendor: Red Hat
product: Red Hat Integration Service Registry
cpes: cpe:/a:redhat:service_registry:2
default_status: affected
vendor: Red Hat
product: Red Hat JBoss A-MQ 7
cpes: cpe:/a:redhat:amq_broker:7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Data Grid 7
cpes: cpe:/a:redhat:jboss_data_grid:7
default_status: unknown
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 6
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:6
default_status: unknown
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform Expansion Pack
cpes: cpe:/a:redhat:jbosseapxp
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Fuse 6
cpes: cpe:/a:redhat:jboss_fuse:6
default_status: unknown
vendor: Red Hat
product: Red Hat JBoss Fuse 7
cpes: cpe:/a:redhat:jboss_fuse:7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Fuse Service Works 6
cpes: cpe:/a:redhat:jboss_fuse_service_works:6
default_status: unknown
vendor: Red Hat
product: Red Hat JBoss Web Server 3
cpes: cpe:/a:redhat:jboss_enterprise_web_server:3
default_status: unknown
vendor: Red Hat
product: Red Hat JBoss Web Server 5
cpes: cpe:/a:redhat:jboss_enterprise_web_server:5
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift Application Runtimes
cpes: cpe:/a:redhat:openshift_application_runtimes:1.0
default_status: unaffected
vendor: Red Hat
product: Red Hat Process Automation 7
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7
default_status: affected
vendor: Red Hat
product: Red Hat Single Sign-On 7
cpes: cpe:/a:redhat:red_hat_single_sign_on:7
default_status: affected
vendor: Red Hat
product: Red Hat Software Collections
cpes: cpe:/a:redhat:rhel_software_collections:3
default_status: affected
vendor: Red Hat
product: Red Hat Software Collections
cpes: cpe:/a:redhat:rhel_software_collections:3
default_status: unaffected
vendor: Red Hat
product: Red Hat Software Collections
cpes: cpe:/a:redhat:rhel_software_collections:3
default_status: unaffected
vendor: Red Hat
product: Red Hat Software Collections
cpes: cpe:/a:redhat:rhel_software_collections:3
default_status: affected
vendor: Red Hat
product: Red Hat Software Collections
cpes: cpe:/a:redhat:rhel_software_collections:3
default_status: affected
vendor: Red Hat
product: Red Hat Software Collections
cpes: cpe:/a:redhat:rhel_software_collections:3
default_status: unaffected
vendor: Red Hat
product: Red Hat Software Collections
cpes: cpe:/a:redhat:rhel_software_collections:3
default_status: affected
vendor: Red Hat
product: Red Hat Software Collections
cpes: cpe:/a:redhat:rhel_software_collections:3
default_status: unaffected
vendor: Red Hat
product: Red Hat Software Collections
cpes: cpe:/a:redhat:rhel_software_collections:3
default_status: affected
vendor: Red Hat
product: Red Hat Software Collections
cpes: cpe:/a:redhat:rhel_software_collections:3
default_status: affected
vendor: Red Hat
product: Red Hat Software Collections
cpes: cpe:/a:redhat:rhel_software_collections:3
default_status: affected
vendor: Red Hat
product: Red Hat Software Collections
cpes: cpe:/a:redhat:rhel_software_collections:3
default_status: unaffected
vendor: Red Hat
product: Red Hat support for Spring Boot
cpes: cpe:/a:redhat:openshift_application_runtimes:1.0
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-09-25T19:20:57.329Z