CVE-2022-0265

CRITICAL9.8EPSS 8.3%

XML External Entity Reference in Hazelcast

Published: 3/4/2022Modified: 2/19/2024

Description

The AbstractXmlConfigRootTagRecognizer() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.

Affected packages (1)

Maven/com.hazelcast:hazelcast>= 5.1-beta1, < 5.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-0265
WEBhttps://github.com/hazelcast/hazelcast
WEBhttps://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748
WEBhttps://github.com/hazelcast/hazelcast/pull/20407
WEBhttps://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563