CVE-2022-4245: codehaus-plexus plexus-utils
CVSS: 4.3v3.1MediumModified
AliasesUBUNTU-CVE-2022-4245DEBIAN-CVE-2022-4245CGA-29c9-4j6j-xh24CGA-2c6p-v62f-wfp7CGA-2cf4-gf95-v78jCGA-2m3w-564x-7gjmCGA-2mmr-mm4h-p2qfCGA-2p74-c4x6-rp5rCGA-2pc5-p337-9fq2CGA-2vp4-jqhq-f6c4CGA-2w5h-p54c-7mhxCGA-338c-jc33-83xfCGA-36q4-xw56-fx3gCGA-3hh4-c535-wm5pCGA-3hw7-6fh7-h5p2CGA-3rm4-c9g5-2f7gCGA-3x77-3rf6-m5mwCGA-4597-g597-fvhgCGA-47v9-pmwr-xq5mCGA-4f6x-36vm-mghfCGA-4hgv-pfhv-m48hCGA-4p8x-9j48-w443CGA-54gh-7pc8-6327CGA-5cc6-gfx9-q33qCGA-5hc7-2wxf-rg52CGA-5jfv-qm24-g5mqCGA-5m3p-fx4c-g637CGA-5p6j-pw54-w72fCGA-5r89-v2xh-q97rCGA-5v74-hgjh-cj2gCGA-6cjj-h8g4-9f4hCGA-6q3q-863h-xxwjCGA-6vmw-wxhm-wc8mCGA-6vvm-7m38-mcxvCGA-6xmc-8hg3-pf65CGA-73ph-mfp7-8gqjCGA-74fr-6928-xj6hCGA-7625-f2gw-q4mhCGA-7752-9qqj-96jxCGA-7fjc-59p5-vfjmCGA-7rw8-8mm5-32cwCGA-8685-3gcm-jq5pCGA-88qw-85qq-4w58CGA-8pc5-3w6m-v8xgCGA-8pxh-x2c6-9v3hCGA-8x8h-x3w9-vqr9CGA-928q-phm3-w7vqCGA-92x3-43rg-wqvmCGA-9c77-2vfw-w876CGA-9h7x-m7c3-xh7hCGA-9q43-v53p-9xwjCGA-9q7h-fjr6-v66xCGA-c7h9-q49x-mprhCGA-c8c8-j5fh-8w2gCGA-ch8x-qff8-qvg2CGA-cp4g-gf5q-hg28CGA-cw7m-rhh6-r65pCGA-cxwp-qqqf-ww96CGA-f4j6-f5qw-m2c6CGA-f7xp-q36x-255qCGA-f8m9-cgh6-2v9pCGA-ffmg-f354-x2xmCGA-fgf3-5398-9hjgCGA-fj2c-m3gf-2c8vCGA-fjr4-287m-72c8CGA-fm6f-7j2f-324pCGA-frcw-2vh7-3c6vCGA-fvqf-gw9v-276qCGA-fwm8-wf33-39v3CGA-g466-mgjv-p633CGA-g77x-r8gf-3r95CGA-g7gw-86hc-496gCGA-gfgr-j3ph-qjm3CGA-gqc4-fqgq-79h5CGA-gqfj-vfm2-58jmCGA-gv4q-f98q-f344CGA-gvj5-cg77-4j4pCGA-gxg9-4cx7-3cxvCGA-gxx8-mqg4-fhvhCGA-h259-7j7g-ph55CGA-h5j4-cgv8-wm7pCGA-h77m-mph7-3jf7CGA-h89v-cmv4-2gpcCGA-hfgh-xwx3-ccmrCGA-hjhm-j8pv-m4rrCGA-hmgv-p2c8-mfw9CGA-hmpm-jwh3-j3mvCGA-hvhm-wvpg-m2w2CGA-jp77-j2mr-4xc4CGA-jr5g-c92j-x73qCGA-m398-5hx6-gm3rCGA-m45v-mrw5-c9qxCGA-m4ff-58hp-vx8mCGA-m6mw-xf89-fc4wCGA-mc85-whfc-2qjrCGA-mf8x-q3jr-fq4rCGA-mjv2-p8jh-mpw2CGA-p299-prgm-3j6vCGA-p2xq-667m-52crCGA-p4xg-mh3r-wqj4CGA-p5fh-8rrh-h46xCGA-p767-pcmp-jh5gCGA-p852-8mj6-f77cCGA-pfr8-mq24-6jccCGA-pgrf-7cfh-59vhCGA-pjjw-frpw-qhf8CGA-pm4m-943g-hg8hCGA-pqgp-6v9r-f4m6CGA-prvv-7frm-3r5jGHSA-jcwr-x25h-x5fhCGA-px6c-vh3c-pw5gCGA-q28p-2r6w-5mhhCGA-q32f-598j-xh3mCGA-q3h7-cwg8-9q8wCGA-q74r-c4xf-m8fpCGA-q7pf-grgv-4jfqCGA-q8m9-xh69-3f5jCGA-q9g3-f3f5-9gcwCGA-qh6x-43p7-v6gxCGA-qp3w-r27r-5m7xCGA-qqff-rvcg-mrp8CGA-qr5j-q34f-2mfqCGA-qrmf-pfxv-cgxcCGA-qvw6-pr7q-9xjpCGA-r26g-rr44-2mcpCGA-r276-7vqh-rg87CGA-r293-f547-x2g7CGA-r3r6-cg9p-gp79CGA-r652-g69x-hgxrCGA-r695-cm58-83c7CGA-r7pw-2799-jmc6CGA-rc8x-4736-cpm8CGA-rf4c-gfwj-cp52CGA-rfjc-3p4h-hfhvCGA-rfp9-75xr-5m58CGA-rpj4-jc36-qq27CGA-rpmh-2924-67g9CGA-rvh9-2pcp-gjhrCGA-rw8f-jf4r-3w6cCGA-v6jw-wmv3-w8v6CGA-v6vq-r9qq-hhcmCGA-v8jv-7fg5-37x9CGA-v992-3rp2-33g4CGA-vj3q-pxfj-rmp3CGA-vpgm-8p2p-fqjhCGA-vr38-9g2g-8fp2CGA-vv82-2qmw-pg2fCGA-vx4w-gw56-v8p2CGA-w3c8-j8q7-v9mmCGA-w4gq-7753-qrqjCGA-w58c-mfvh-j92fCGA-wcfp-c7c2-x5qmCGA-wgj7-c663-rh29CGA-wv62-hxrv-gq76CGA-wvm2-78m3-grmmCGA-ww6p-465r-3mh2CGA-wwmj-gg24-75jvCGA-wxw9-fm2h-jw25CGA-x79p-v285-33pvCGA-x79x-h4hw-7ffxCGA-xc36-h7hc-p47xCGA-xr85-x3qv-2qqpCGA-xwf9-fq9g-q489CGA-xwhj-qcqv-949j
Published 25-09-2023Last modified 03-08-2024
Vulnerability summary
CVE-2022-4245 is a medium (CVSS 4.3) vulnerability in codehaus-plexus plexus-utils. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52% of scored vulnerabilities.
CVSS score
4.3/10
010
Medium · v3.1 (CVE.org)EPSS score
0.69%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 25-09-2023PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.
CVSS metrics
6 scores · 6 sources · 1 versionMedium 4.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · MavenEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.69%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
0.00 pp
From 0.69% on 19-09-2026
19-09-202619-10-2026
EPSS score0.69%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-91XML Injection (aka Blind XPath Injection)The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
- CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Affected systems
Chainguard51 products
- eco-java-gradle-1.11All versions (No fix recorded)
- eco-java-gradle-2.0All versions (No fix recorded)
- eco-java-gradle-2.1All versions (No fix recorded)
- eco-java-gradle-2.10All versions (No fix recorded)
- eco-java-gradle-2.11All versions (No fix recorded)
Codehaus-plexus1 product
- plexus-utils< 3.0.24
Debian1 product
- plexus-utils2< 3.0.24-1
Org.codehaus.plexus1 product
- plexus-utils< 3.0.24
Redhat1 product
- integration_camel_k< 1.10.1
Ubuntu1 product
- plexus-utils2All versions (No fix recorded)
6 vendors · 56 products
References
15 links- access.redhat.com/errata/RHSA-2023:2135Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
- access.redhat.com/errata/RHSA-2023:3906Vendor AdvisoryX Refsource REDHATAdvisoryWEBThird Party Advisory
- access.redhat.com/security/cve/CVE-2022-4245VDB EntryX Refsource REDHATAdvisoryWEBThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2149843Issue TrackingX Refsource REDHATREPORTWEBThird Party Advisory
