CVE-2022-0265 Improper Restriction of XML External Entity Reference in hazelcast/hazelcast
An attacker can exploit XML External Entity vulnerabilities in Hazelcast to read sensitive files or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-0265?
CVE-2022-0265 is a high-severity vulnerability in hazelcast/hazelcast, published on 3 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.
Weakness: CWE-611
Which versions are affected by CVE-2022-0265?
2 open source packages ship an affected version, including com.hazelcast:hazelcast. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.hazelcast:hazelcast Maven | From 5.1-beta1 | 5.1 |
com.hazelcast:hazelcast Maven | From 5.1-beta1 | 5.1 |
Products include Hazelcast Hazelcast.
How do I fix CVE-2022-0265?
Upgrade com.hazelcast:hazelcast to 5.1 or later.
Is CVE-2022-0265 being exploited?
There is no known exploitation of CVE-2022-0265 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in hazelcast/hazelcast
Sources
Also known as GHSA-99wh-973f-779p.