CVE-2022-4725

A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java of the component XML Parser. The manipulation leads to server-side request forgery. Upgrading to version 2.59.1 is able to address this issue. The name of the patch is c3e6d69422e1f0c80fe53f2d757b8df97619af2b. It is recommended to upgrade the affected component. The identifier VDB-216737 was assigned to this vulnerability.

• CWE-918

• https://github.com/aws-amplify/aws-sdk-android/commit/c3e6d69422e1f0c80fe53f2d757b8df97619af2bPatch, Third Party Advisory
• https://github.com/aws-amplify/aws-sdk-android/pull/3100Patch, Third Party Advisory
• https://github.com/aws-amplify/aws-sdk-android/releases/tag/release_v2.59.1Release Notes, Third Party Advisory
• https://vuldb.com/?id.216737Third Party Advisory
• https://github.com/aws-amplify/aws-sdk-android/commit/c3e6d69422e1f0c80fe53f2d757b8df97619af2bPatch, Third Party Advisory
• https://github.com/aws-amplify/aws-sdk-android/pull/3100Patch, Third Party Advisory
• https://github.com/aws-amplify/aws-sdk-android/releases/tag/release_v2.59.1Release Notes, Third Party Advisory
• https://vuldb.com/?id.216737Third Party Advisory

Published

Dec 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-47211Microsoft Office Graphics Remote Code Execution Vulnerabilit…7.8
• CVE-2022-47212Microsoft Office Graphics Remote Code Execution Vulnerabilit…7.8
• CVE-2022-47213Microsoft Office Graphics Remote Code Execution Vulnerabilit…7.8
• CVE-2022-4722Authentication Bypass by Primary Weakness in GitHub reposito…7.2
• CVE-2022-4723Allocation of Resources Without Limits or Throttling in GitH…6.5
• CVE-2022-4724Improper Access Control in GitHub repository ikus060/rdiffwe…9.8
• CVE-2022-4726A vulnerability classified as critical was found in SourceCo…9.8
• CVE-2022-4727A vulnerability, which was classified as problematic, was fo…6.1
• CVE-2022-4728A vulnerability has been found in Graphite Web and classifie…5.4
• CVE-2022-4729A vulnerability was found in Graphite Web and classified as …5.4
• CVE-2022-4730A vulnerability was found in Graphite Web. It has been class…5.4
• CVE-2022-4731A vulnerability, which was classified as problematic, was fo…5.4