Skip to content
Fencer Intel
medium 4.3

CVE-2022-4245 json

Codehaus-plexus: xml external entity (xxe) injection

published 3y ago modified 4mo ago also GHSA-jcwr-x25h-x5fh , EUVD-2023-2535

cvss
4.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits
0
none known

Summary

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.

Patch / fix

  • maven org.codehaus.plexus:plexus-utils 3.0.24
  • codehaus-plexus plexus-utils 3.0.24
  • redhat integration_camel_k 1.10.1
  • plexus-utils2 Debian 14, Debian 13, Debian 12 3.0.24-1

debian advisories DEBIAN-CVE-2022-4245

Is CVE-2022-4245 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-4245 updated cvss 4.3

codehaus-plexus: XML External Entity (XXE) Injection

  • Red Hat A-MQ Clients 2 codehaus-plexus codehaus-plexus Red Hat AMQ Broker 7 codehaus-plexus codehaus-plexus
    affected: no fix planned “Will not fix”
  • Red Hat build of Apache Camel for Spring Boot 3 codehaus-plexus codehaus-plexus
    affected: no fix available “Fix deferred”
  • Red Hat build of Apicurio Registry 2 codehaus-plexus codehaus-plexus
    affected: no fix available
  • Red Hat build of Debezium 1 codehaus-plexus codehaus-plexus
    affected: no fix planned “Will not fix”
  • Red Hat build of Quarkus codehaus-plexus codehaus-plexus
    affected: no fix available
  • Red Hat Data Grid 8 codehaus-plexus codehaus-plexus
    affected: no fix planned “Will not fix”
  • Red Hat Decision Manager 7 codehaus-plexus codehaus-plexus Red Hat Enterprise Linux 7 plexus-utils, plexus-utils-javadoc
    affected: no fix planned “Out of support scope”
  • Red Hat Fuse 7 codehaus-plexus codehaus-plexus Red Hat Integration Camel Quarkus 1 codehaus-plexus codehaus-plexus
    affected: no fix planned “Will not fix”
show 8 more
  • Red Hat JBoss Data Grid 7 codehaus-plexus codehaus-plexus Red Hat JBoss Enterprise Application Platform 6 codehaus-plexus codehaus-plexus
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack codehaus-plexus codehaus-plexus
    affected: no fix available
  • Red Hat JBoss Fuse 6 codehaus-plexus codehaus-plexus Red Hat JBoss Fuse Service Works 6 codehaus-plexus codehaus-plexus Red Hat JBoss Web Server 3 codehaus-plexus codehaus-plexus
    affected: no fix planned “Out of support scope”
  • Red Hat Process Automation 7 codehaus-plexus codehaus-plexus
    affected: no fix available
  • Red Hat Single Sign-On 7 org.codehaus.plexus-plexus-utils org.codehaus.plexus-plexus-utils Red Hat Software Collections rh-maven36-byte-buddy, rh-maven36-maven-surefire, rh-maven36-byte-buddy-agent, rh-maven36-byte-buddy-parent, rh-maven36-byte-buddy-javadoc, rh-maven36-maven-shade-plugin, +17 more Red Hat support for Spring Boot codehaus-plexus codehaus-plexus
    affected: no fix planned “Will not fix”
  • Red Hat RHINT Camel-K-1.10.1
    fixed: vendor fix RHSA-2023:3906
  • Red Hat RHPAM 7.13.1 async
    fixed: vendor fix RHSA-2023:2135
  • Red Hat A-MQ Online codehaus-plexus codehaus-plexus Red Hat Enterprise Linux 8 plexus-utils, plexus-utils-javadoc Red Hat Enterprise Linux 9 plexus-utils Red Hat JBoss Enterprise Application Platform 7 codehaus-plexus codehaus-plexus Red Hat JBoss Web Server 5 codehaus-plexus codehaus-plexus Red Hat OpenShift Application Runtimes codehaus-plexus codehaus-plexus
    +1 more products
    Red Hat Software Collections rh-maven36-maven, rh-maven36-maven-lib, rh-maven36-plexus-utils, rh-maven36-maven-javadoc, rh-maven36-maven-archiver, rh-maven36-maven-jar-plugin, +5 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2y ago

Exploit prediction

0.69% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
GitHub 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.codehaus.plexus:plexus-utils
<3.0.24
3.0.24

Affected products

  • Red Hat RHINT Camel-K-1.10.1
  • Red Hat RHPAM 7.13.1 async
  • Red Hat A-MQ Clients 2
  • Red Hat Red Hat A-MQ Online
  • Red Hat Red Hat build of Apache Camel for Spring Boot
  • Red Hat Red Hat build of Quarkus
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Decision Manager 7
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Integration Camel Quarkus
  • Red Hat Red Hat Integration Change Data Capture
  • Red Hat Red Hat Integration Service Registry
  • Red Hat Red Hat JBoss A-MQ 7
  • Red Hat Red Hat JBoss Data Grid 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 6
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat JBoss Fuse 6
  • Red Hat Red Hat JBoss Fuse 7
  • Red Hat Red Hat JBoss Fuse Service Works 6
  • Red Hat Red Hat JBoss Web Server 3
  • Red Hat Red Hat JBoss Web Server 5
  • Red Hat Red Hat OpenShift Application Runtimes
  • Red Hat Red Hat Process Automation 7
  • Red Hat Red Hat Single Sign-On 7
  • Red Hat Red Hat Software Collections
  • Red Hat Red Hat support for Spring Boot

Classification

Weakness
  • CWE-91 XML Injection
  • CWE-611 Improper Restriction of XML External Entity Reference
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.