Codehaus-plexus: xml external entity (xxe) injection
Priority LOW 21CWE-91Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 2 fixed, 21 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-611 and the CVSS impact.
Summary
A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00694 53rd percentileScored 2026-11-07
Fix Partial org.codehaus.plexus:plexus-utils (Maven): 3.0.24Red Hat: 2 advisoriesRed Hat: 2 fixed, 21 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | RHINT Camel-K-1.10.1 | — | — | Not affected | CNA |
| Red Hat | RHPAM 7.13.1 async | — | — | Not affected | CNA |
| Red Hat | A-MQ Clients 2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat A-MQ Online | — | — | No fix listed | CNA |
| Red Hat | Red Hat build of Apache Camel for Spring Boot | — | — | No fix listed | CNA |
| Red Hat | Red Hat build of Quarkus | — | — | No fix listed | CNA |
| Red Hat | Red Hat Data Grid 8 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Decision Manager 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat Integration Camel Quarkus | — | — | No fix listed | CNA |
| Red Hat | Red Hat Integration Change Data Capture | — | — | No fix listed | CNA |
| Red Hat | Red Hat Integration Service Registry | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss A-MQ 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Fuse 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Fuse 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Fuse Service Works 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Web Server 3 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Web Server 5 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Application Runtimes | — | — | Not affected | CNA |
| Red Hat | Red Hat Process Automation 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Single Sign-On 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Software Collections | — | — | No fix listed | CNA |
| Red Hat | Red Hat Software Collections | — | — | Not affected | CNA |
| Red Hat | Red Hat Software Collections | — | — | Not affected | CNA |
| Red Hat | Red Hat Software Collections | — | — | No fix listed | CNA |
| Red Hat | Red Hat Software Collections | — | — | No fix listed | CNA |
| Red Hat | Red Hat Software Collections | — | — | Not affected | CNA |
| Red Hat | Red Hat Software Collections | — | — | No fix listed | CNA |
| Red Hat | Red Hat Software Collections | — | — | Not affected | CNA |
| Red Hat | Red Hat Software Collections | — | — | No fix listed | CNA |
| Red Hat | Red Hat Software Collections | — | — | No fix listed | CNA |
| Red Hat | Red Hat Software Collections | — | — | No fix listed | CNA |
| Red Hat | Red Hat Software Collections | — | — | Not affected | CNA |
| Red Hat | Red Hat support for Spring Boot | — | — | No fix listed | CNA |
| — | org.codehaus.plexus:plexus-utils (Maven) | before 3.0.24 | 3.0.24 | Patch available | GHSA-jcwr-x25h-x5fh |
- RHINT Camel-K-1.10.1 VendorRed Hat Affected — Fixed in — Not affected CNA
- RHPAM 7.13.1 async VendorRed Hat Affected — Fixed in — Not affected CNA
- A-MQ Clients 2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat A-MQ Online VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat build of Apache Camel for Spring Boot VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat build of Quarkus VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Data Grid 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Decision Manager 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Integration Camel Quarkus VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Integration Change Data Capture VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Integration Service Registry VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss A-MQ 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Data Grid 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Enterprise Application Platform 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Enterprise Application Platform 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Fuse 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Fuse 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Fuse Service Works 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Web Server 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Web Server 5 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Application Runtimes VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Process Automation 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Software Collections VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat support for Spring Boot VendorRed Hat Affected — Fixed in — No fix listed CNA
- org.codehaus.plexus:plexus-utils (Maven) Vendor— Affected before 3.0.24 Fixed in 3.0.24 Patch available GHSA-jcwr-x25h-x5fh
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:codehaus-plexus:plexus-utils:*:*:*:*:*:*:*:* | before 3.0.24 | Vulnerable | codehaus-plexus |
| cpe:2.3:a:redhat:integration_camel_k:*:*:*:*:*:*:*:* | before 1.10.1 | Vulnerable | Red Hat |
- cpe:2.3:a:codehaus-plexus:plexus-utils:*:*:*:*:*:*:*:* Versions before 3.0.24 Vulnerable ·codehaus-plexus
- cpe:2.3:a:redhat:integration_camel_k:*:*:*:*:*:*:*:* Versions before 1.10.1 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-jcwr-x25h-x5fh org.codehaus.plexus:plexus-utils (Maven) Fixed in 3.0.24 Advisory →
Red Hat 2 advisories
- RHSA-2023:3906 Released 2023-06-28 · Red Hat rating ImportantRed Hat Integration Camel K 1.10.1 release security update
- RHINT Camel-K-1.10.1
- RHSA-2023:2135 Released 2023-05-04 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.3 security update
- RHPAM 7.13.1 async
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Red Hat A-MQ Clients 2, RHINT Camel-K-1.10.1 and 27 more products — RHSA-2023:3906
2 records Highest priority Priority HIGH 1 HIGH, 1 LOW
Other records, highest priority first
- TI-2022-03885 Codehaus-plexus: directory traversalPriority HIGH 72
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| A-MQ Clients 2 | Affected | No fix planned: Will not fix |
| Red Hat AMQ Broker 7 | Affected | No fix planned: Will not fix |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Web Server 3 | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix yet |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Red Hat build of Debezium 1 | Affected | No fix planned: Will not fix |
| Red Hat build of Quarkus | Affected | No fix yet |
| Red Hat support for Spring Boot | Affected | No fix planned: Will not fix |
| RHINT Camel-K-1.10.1 | Fixed | RHSA-2023:3906 |
| RHPAM 7.13.1 async | Fixed | RHSA-2023:2135 |
Not affected: 7 products
- Red Hat A-MQ Online
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Web Server 5
- Red Hat OpenShift Application Runtimes
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2022-4245
- 2026-10-03 Alias added: GHSA-jcwr-x25h-x5fh
References
Advisory 5
More Red Hat Integration Camel K vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2021-02983 Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 CVSS 3.1HIGH 7.5
- TI-2022-03885 Codehaus-plexus: directory traversal CVSS 3.1HIGH 7.5
- TI-2023-04469 Quarkus: http security policy bypass CVSS 3.1HIGH 8.1
- TI-2022-04106 Server-side request forgery in undertow CVSS 3.1HIGH 7.5
- TI-2024-07308 Undertow: improper state management in proxy protocol parsing causes information leakage CVSS 3.1HIGH 7.5
Sources
- CVE-2022-4245 · CVE Program
- CVE-2022-4245 · NVD
- FIRST EPSS
- GHSA-jcwr-x25h-x5fh · GitHub Advisory Database · CC BY 4.0
- CVE-2022-4245 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences