A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.
CVE-2022-4245 - Medium Severity Vulnerability
A collection of various utility classes to ease working with strings, files, command lines, XML and more.
Path to dependency file: /test/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/plexus/plexus-utils/3.0.10/plexus-utils-3.0.10.jar
Dependency Hierarchy: - maven-plugin-2.14.jar (Root Library) - maven-core-3.1.0.jar - :x: **plexus-utils-3.0.10.jar** (Vulnerable Library)
Found in HEAD commit: 3abfb254ea347629c1aed893510d133a3831c30e
Found in base branch: master
A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.
Publish Date: 2023-09-25
URL: CVE-2022-4245
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://bugzilla.suse.com/show_bug.cgi?id=1205930
Release Date: 2023-09-25
Fix Resolution: org.codehaus.plexus:plexus-utils:3.0.24
Step up your Open Source Security Game with Mend here