The vulnerability of the codehaus-plexus framework of Apache Maven is related to an incorrect restriction on XML references to external objects, which allows a hacker to execute arbitrary code.

🗓️ 28 Feb 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 6 Views

Plexus framework in Apache Maven allows remote code execution due to improper restriction on external object references.

Reporter	Title	Published	Views	Family All 30
IBM Security Bulletins	Security Bulletin: IBM Cognos Controller is affected by vulnerabilities	15 Apr 202503:54	–	ibm
ATTACKERKB	CVE-2022-4245	25 Sep 202320:15	–	attackerkb
Circl	CVE-2022-4245	26 Sep 202300:34	–	circl
CNNVD	codehaus-plexus 代码问题漏洞	1 Dec 202200:00	–	cnnvd
CVE	CVE-2022-4245	25 Sep 202319:20	–	cve
Cvelist	CVE-2022-4245 Codehaus-plexus: xml external entity (xxe) injection	25 Sep 202319:20	–	cvelist
Debian CVE	CVE-2022-4245	25 Sep 202319:20	–	debiancve
EUVD	EUVD-2023-2535	3 Oct 202520:07	–	euvd
Github Security Blog	codehaus-plexus vulnerable to XML injection	25 Sep 202321:30	–	github
NCSC	Vulnerabilities fixed in IBM Cognos Controller	21 Feb 202508:40	–	ncsc

Vulners

Node

red_hat red_hat_jboss_fuseMatch7

OR

red_hat red_hat_single_sign-onMatch7

OR

red_hat red_hat_jboss_fuseMatch6

OR

red_hat red_hat_jboss_data_gridMatch7

OR

red_hat a-mq_clientsMatch2

OR

red_hat red_hat_process_automationMatch7

OR

red_hat red_hat_data_gridMatch8

OR

red_hat red_hat_jboss_fuse_service_worksMatch6

OR

novell suse_manager_proxyMatch4.2

OR

novell suse_manager_serverMatch4.2

OR

novell suse_enterprise_storageMatch7

OR

novell suse_manager_serverMatch4.1

OR

novell suse_manager_proxyMatch4.1

OR

novell suse_manager_retail_branch_serverMatch4.1

OR

novell suse_manager_retail_branch_serverMatch4.2

OR

novell suse_manager_retail_branch_serverMatch4.3

OR

novell suse_manager_proxyMatch4.3

OR

novell suse_manager_serverMatch4.3

OR

novell suse_enterprise_storageMatch7.1

OR

red_hat decision_managerMatch7

OR

red_hat red_hat_jboss_a-mqMatch7

OR

red_hat red_hat_jboss_enterprise_application_platformMatch6

OR

codehaus plexusRange<3.0.24

OR

red_hat red_hat_integration_camel_kMatch1.10.1

OR

red_hat red_hat_jboss_web_serverMatch3

OR

elastic_nv logstashMatch8.12.1

OR

red_hat red_hat_enterprise_linuxMatch7

Source	Link
access	www.access.redhat.com/errata/RHSA-2023:3906
access	www.access.redhat.com/security/cve/CVE-2022-4246
github	www.github.com/codehaus-plexus/plexus-utils/commit/f933e5e78dc2637e485447ed821fe14904f110de
github	www.github.com/codehaus-plexus/plexus-utils/issues/3
suse	www.suse.com/security/cve/CVE-2022-4245.html
security-tracker	www.security-tracker.debian.org/tracker/CVE-2022-4245
web	www.web.nvd.nist.gov/view/vuln/detail

21 Mar 2024 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 24

CVSS 34.3

EPSS0.00694

Plexus framework Apache Maven external object references remote code execution