CVE-2022-28890

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.

• CWE-611

• https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878Mailing List, Vendor Advisory
• https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878Mailing List, Vendor Advisory

Published

May 5, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-28885A Denial-of-Service (DoS) vulnerability was discovered in th…7.5
• CVE-2022-28886A Denial-of-Service vulnerability was discovered in the F-Se…5.5
• CVE-2022-28887Multiple Denial-of-Service (DoS) vulnerability was discovere…7.5
• CVE-2022-28888Spryker Commerce OS 1.4.2 allows Remote Command Execution.9.8
• CVE-2022-28889In Apache Druid 0.22.1 and earlier, the server did not set a…4.3
• CVE-2022-2889Use After Free in GitHub repository vim/vim prior to 9.0.022…7.8
• CVE-2022-28892Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 is vuln…8.8
• CVE-2022-28893The SUNRPC subsystem in the Linux kernel through 5.17.2 can …7.8
• CVE-2022-28895A command injection vulnerability in the component /setnetwo…9.8
• CVE-2022-28896A command injection vulnerability in the component /setnetwo…9.8
• CVE-2022-2890Cross-site Scripting (XSS) - Stored in GitHub repository yet…5.4
• CVE-2022-28901A command injection vulnerability in the component /SetTrigg…9.8