CVE-2022-2838
Last modified
CVE-2022-2838 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection of arbitrary definitions which is able to access local files and expose their contents via HTTP requests.. EPSS estimates a 0.46% chance of exploitation in the next 30 days.
Description
In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection of arbitrary definitions which is able to access local files and expose their contents via HTTP requests.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Eclipse | Sphinx | >= 0.7.0, < 0.13.1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-2838?
How severe is CVE-2022-2838?
How do I fix CVE-2022-2838?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-28374Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does no…8.8
- CVE-2022-28375Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does no…9.8
- CVE-2022-28376Verizon 5G Home LVSKIHP outside devices through 2022-02-15 a…8.1
- CVE-2022-28377On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and O…7.5
- CVE-2022-28378Craft CMS before 3.7.29 allows XSS.6.1
- CVE-2022-28379jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during…4.8
- CVE-2022-28380The rc-httpd component through 2022-03-31 for 9front (Plan 9…7.5
- CVE-2022-28381Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buff…9.8
- CVE-2022-28382An issue was discovered in certain Verbatim drives through 2…7.5
- CVE-2022-28383An issue was discovered in certain Verbatim drives through 2…6.8
- CVE-2022-28384An issue was discovered in certain Verbatim drives through 2…5.5
- CVE-2022-28385An issue was discovered in certain Verbatim drives through 2…4.6
Are you affected by CVE-2022-2838?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST