hazelcast/hazelcast · Security
XML External Entity Reference in Hazelcast
- GHSA ID
- GHSA-99wh-973f-779p
- CVE ID
- CVE-2022-0265
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The AbstractXmlConfigRootTagRecognizer() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.
CWEs
- CWE-611 · Improper Restriction of XML External Entity Reference
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-0265 ↗
- https://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748 ↗
- https://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563 ↗
- https://github.com/hazelcast/hazelcast/pull/20407 ↗
- https://github.com/advisories/GHSA-99wh-973f-779p ↗