critical9.8
CVE-2022-0265
XML External Entity Reference in Hazelcast
Impact
The AbstractXmlConfigRootTagRecognizer() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.hazelcast:hazelcast | >= 5.1-beta1, < 5.1 | 5.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hazelcast | Hazelcast | Version 5.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748
- https://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563
- https://github.com/advisories/GHSA-99wh-973f-779p
- https://nvd.nist.gov/vuln/detail/CVE-2022-0265
- https://github.com/hazelcast/hazelcast/pull/20407