Read the docs
TI-2022-02269 Aliases CVE-2022-2458GHSA-hfj4-xq5f-7mc7

XML injection in Red Hat Process Automation Manager 7

Priority LOW 37CWE-91Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

XML external entity injection(XXE) is a vulnerability that allows an attacker to interfere with an application's processing of XML data. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. Here, XML external entity injection lead to External Service interaction & Internal file read in Business Central and also Kie-Server APIs.

Why it matters now

EPSS 0.00815 57th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Red Hat Process Automation Manager 7Fixed in 7.13.1—No fix listedCNA
  • Red Hat Process Automation Manager 7 Vendor— Affected Fixed in 7.13.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:process_automation_manager:*:*:*:*:*:*:*:*before 7.13.1VulnerableRed Hat
  • cpe:2.3:a:redhat:process_automation_manager:*:*:*:*:*:*:*:* Versions before 7.13.1 Vulnerable ·Red Hat

Remediation

Red Hat 1 advisory

  • RHSA-2022:6813 Released 2022-10-05 · Red Hat rating Important
    Red Hat Process Automation Manager 7.13.1 security update
    • RHPAM 7.13.1 async

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Process Automation 7AffectedNo fix yet
RHPAM 7.13.1 asyncFixed RHSA-2022:6813

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2458
  2. 2026-10-03 Alias added: GHSA-hfj4-xq5f-7mc7

References

Advisory 1

  • TI-2022-02268 Missing brute-force protection in Red Hat Process Automation Manager 7 CVSS 3.1CRITICAL 9.8
  • TI-2023-04469 Quarkus: http security policy bypass CVSS 3.1HIGH 8.1
  • TI-2025-36373 Rhpam: privilege escalation via excessive /etc/passwd permissions CVSS 3.1MEDIUM 6.4
  • TI-2019-11090 Cleartext storage of sensitive information in Red Hat Business-central CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences