Vulnerability record · CVE-2022-4245 · published 25 September 2023

CVE-2022-4245: Codehaus-plexus plexus-utils xml injection vulnerability

CCodehaus Plexus · Plexus Utils

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.

4.3 CVSS 3.1 Medium EPSS 0.69% · top 49.0% CWE-91 · XML injectionCWE-611 · XML external entity (XXE)

4.3CVSS 3.1 base score

0.69%EPSS exploitation probability, 30 days

NoNot in CISA KEV

2Affected product versions listed by NVD

8References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

CPlexus Utils Codehaus Plexus

Integration Camel K Redhat

References

Link	Tags
https://access.redhat.com/errata/RHSA-2023:2135	Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:3906	Third Party Advisory
https://access.redhat.com/security/cve/CVE-2022-4245	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2149843	Issue TrackingThird Party Advisory
https://access.redhat.com/errata/RHSA-2023:2135	Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:3906	Third Party Advisory
https://access.redhat.com/security/cve/CVE-2022-4245	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2149843	Issue TrackingThird Party Advisory

Track CVE-2022-4245 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed10 Oct 2023 9.8CVE-2017-1000487Codehaus-plexus plexus-utils os command injection vulnerabilityPlexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.EPSS 6.5%3 Jan 2018 8.8CVE-2025-67030Codehaus-plexus plexus-utils path traversal vulnerabilityDirectory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e001…EPSS 0.66%25 Mar 2026 8.1CVE-2023-4853Quarkus incorrect authorization vulnerabilityA flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulti…EPSS 1.4%20 Sep 2023 7.5CVE-2024-7885Redhat build of apache camel - hawtio race condition vulnerabilityA vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue…EPSS 2.6%21 Aug 2024 7.5CVE-2022-4244Codehaus-plexus plexus-utils path traversal vulnerabilityA flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outsid…EPSS 1.3%25 Sep 2023 7.5CVE-2023-1108Redhat build of quarkus vulnerabilityA flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, wh…EPSS 1.8%14 Sep 2023 7.5CVE-2022-4492Redhat build of quarkus server-side request forgery (ssrf) vulnerabilityThe undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least…EPSS 0.60%23 Feb 2023

Source: NIST National Vulnerability Database (record CVE-2022-4245), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.