9.8

CVE-2022-0839

Exploit

Improper Restriction of XML External Entity Reference in liquibase/liquibase

Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Liquibase ≫ Liquibase Version < 4.8.0
Oracle ≫ Sqlcl Version19c
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.92% 0.852
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
security@huntr.dev 7.3 3.9 3.4
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

https://www.oracle.com/security-alerts/cpujul2022.html
Patch
Third Party Advisory
https://github.com/liquibase/liquibase/commit/33d9d925082097fb1a3d2fc8e44423d964cd9381
Patch
https://huntr.dev/bounties/f1ae5779-b406-4594-a8a3-d089c68d6e70
Patch
Third Party Advisory
Exploit
http://seclists.org/fulldisclosure/2025/Apr/14