GitHub Advisoryadvisory · Maven

GHSA-99wh-973f-779p XML External Entity Reference in Hazelcast

CRITICAL Published 2022-03-04 Modified 2022-03-18 Official page ↗
Aliases
CVE-2022-0265
Ecosystem
Maven
Packages
com.hazelcast:hazelcast
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2022-03-04

Affected packages

• Maven com.hazelcast:hazelcast: >= 5.1-beta1, < 5.1 → fixed in 5.1

Description

The AbstractXmlConfigRootTagRecognizer() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.

Related

Alias · CVE (1)

  • CVE-2022-0265 Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References