CVE-2022-0265

CRITICAL9.8EPSS 8.3%

XML External Entity Reference in Hazelcast

發布日:2022/3/4修改日:2024/2/19

描述

The AbstractXmlConfigRootTagRecognizer() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.

受影響套件(1)

Maven/com.hazelcast:hazelcast>= 5.1-beta1, < 5.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-0265
WEBhttps://github.com/hazelcast/hazelcast
WEBhttps://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748
WEBhttps://github.com/hazelcast/hazelcast/pull/20407
WEBhttps://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563