CVE-2022-0839 Improper Restriction of XML External Entity Reference in liquibase/liquibase
An attacker can exploit XML External Entity vulnerabilities in Liquibase to read sensitive files or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-0839?
CVE-2022-0839 is a high-severity vulnerability in liquibase/liquibase, published on 4 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.
Weakness: CWE-611
Which versions are affected by CVE-2022-0839?
2 open source packages ship an affected version, including org.liquibase:liquibase-core. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.liquibase:liquibase-core Maven | All versions | 4.8.0 |
org.liquibase:liquibase-core Maven | All versions | 4.8.0 |
Products include Liquibase Liquibase, Oracle Sqlcl.
How do I fix CVE-2022-0839?
Upgrade org.liquibase:liquibase-core to 4.8.0 or later.
Is CVE-2022-0839 being exploited?
There is no known exploitation of CVE-2022-0839 in the wild and no public exploit code.
Sources
Also known as GHSA-jvfv-hrrc-6q72.