CVE-2022-0265 - Improper Restriction of XML External Entity Reference in hazelcast/hazelcast

CRITICAL

Improper Restriction of XML External Entity Reference in hazelcast/hazelcast

Published Mar 3, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 2.79%

Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
5.1-BETA-1	affected	-

Product	Package	State	Advisory
Red Hat Fuse 7	hazelcast	Not affected	n/a
Red Hat Integration Camel K 1	hazelcast	Not affected	n/a
Red Hat JBoss Fuse 6	hazelcast	Out of support scope	n/a

Red Hat statement

No RedHat Products are affected by this vulnerability.

Weaknesses (1)

CWE-611

XXE

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-0265		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2063927		Issue Tracking
https://github.com/advisories/GHSA-99wh-973f-779p		Advisory
https://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748		x_refsource_MISCPatchThird Party Advisory
https://github.com/hazelcast/hazelcast/pull/20407
https://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563		x_refsource_CONFIRMExploitIssue TrackingPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-0265
https://www.cve.org/CVERecord?id=CVE-2022-0265