Lucene search
HistoryAug 16, 2022 - 10:15 a.m.
CVE-2022-2838
apache xerces
xml parser
eclipse sphinx
CVSS3
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS
0.001
Percentile
48.1%
In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection of arbitrary definitions which is able to access local files and expose their contents via HTTP requests.
Affected configurations
Node
eclipsesphinxRange0.7.0–0.13.1
References
Related
cve
cve
CVE-2022-2838
2022-08-16 10:15:08
cvelist
cvelist
CVE-2022-2838
2022-08-16 10:10:08
prion
prion
Xxe
2022-08-16 10:15:00
CVSS3
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS
0.001
Percentile
48.1%
Related for NVD:CVE-2022-2838