CVE-2022-25312 An XML external entity (XXE) injection vulnerability exists in the Apache Any23 RDFa XSLTStylesheet extractor
An XXE vulnerability in Apache Any23 allows attackers to read server files and interact with backend systems via crafted XML data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-25312?
CVE-2022-25312 is a critical vulnerability in Apache Any23, published on 4 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Any23 2.7.
Weakness: CWE-611
Which versions are affected by CVE-2022-25312?
2 open source packages ship an affected version, including org.apache.any23:apache-any23. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.any23:apache-any23 Maven | All versions | 2.7 |
org.apache.any23:apache-any23 Maven | All versions | 2.7 |
Products include Apache Any23.
How do I fix CVE-2022-25312?
Upgrade org.apache.any23:apache-any23 to 2.7 or later.
Is CVE-2022-25312 being exploited?
There is no known exploitation of CVE-2022-25312 in the wild and no public exploit code.
Other vulnerabilities in Apache Any23
Sources
Also known as GHSA-2rmm-87v7-34rj.