critical9.8
CVE-2022-0839
Improper Restriction of XML External Entity Reference in Liquibase
Impact
The XMLChangeLogSAXParser() function in Liquibase prior to version 4.8.0 contains an issue that may lead to to Improper Restriction of XML External Entity Reference.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.liquibase:liquibase-core | < 4.8.0 | 4.8.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Liquibase | Liquibase | before 4.8.0 |
| Oracle | Sqlcl | Version 19c |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/liquibase/liquibase/commit/33d9d925082097fb1a3d2fc8e44423d964cd9381
- https://huntr.dev/bounties/f1ae5779-b406-4594-a8a3-d089c68d6e70
- https://www.oracle.com/security-alerts/cpujul2022.html
- http://seclists.org/fulldisclosure/2025/Apr/14
- https://github.com/advisories/GHSA-jvfv-hrrc-6q72
- https://nvd.nist.gov/vuln/detail/CVE-2022-0839