CVE-2022-46751
highpriority · track · 34EPSS 0.020 · 81 %ileDEEURUUSEPSS · scored 2026-10-22
Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy files or Apache Maven POMs - it will allow downloading external document type definitions and expand any entity references contained therein when used. This can be used to exfiltrate data, access resources only the machine running Ivy has access to or disturb the execution of Ivy in different ways. Starting with Ivy 2.5.2 DTD processing is disabled by default except when parsing Maven POMs where the default is to allow DTD processing but only to include a DTD snippet shipping with Ivy that is needed to deal with existing Maven POMs that are not valid XML files but are nevertheless accepted by Maven. Access can be be made more lenient via newly introduced system properties where needed. Users of Ivy prior to version 2.5.2 can use Java system properties to restrict processing of external DTDs, see the section about "JAXP Properties for External Access restrictions" inside Oracle's "Java API for XML Processing (JAXP) Security Guide".
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (67)
Products and version ranges known to be affected.
advisories (7)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2023-2099Apache Ivy: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2023-08-20csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Ivy ausnutzen, um Informationen offenzulegen.
- WID-SEC-W-2023-2286Jenkins Plugins: Mehrere SchwachstellenDeutsch2023-09-06csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Jenkins Plugins ausnutzen, um Dateien zu manipulieren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuführen.
- WID-SEC-W-2023-3070Red Hat JBoss A-MQ: Mehrere SchwachstellenDeutsch2023-12-06csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss A-MQ ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuführen.
- WID-SEC-W-2024-0106Oracle Communications: Mehrere SchwachstellenDeutsch2024-01-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2024-0794Dell ECS: Mehrere SchwachstellenDeutsch2024-04-04csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.
- WID-SEC-W-2024-3456Jenkins Plugins: Mehrere SchwachstellenDeutsch2024-11-13csaf · cert_bundDE
Ein entfernter authentisierter Angreifer oder ein anonymer Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Dateien zu manipulieren, vertrauliche Informationen preiszugeben, beliebigen Code auszuführen, sich erhöhte Rechte zu verschaffen und einen Cross-Site-Scripting-Angriff durchzuführen.
- GHSA-2jc4-r94c-rp7hApache Ivy External Entity Reference vulnerability2023-08-21ghsa · osvUS
Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy files or Apache Maven POMs - it will allow downloading external document type definitions and expand any entity references contained therein when used. This can be used to exfiltrate data, access resources only the machine running Ivy has access to or disturb the execution of Ivy in different ways. Starting with Ivy 2.5.2 DTD processing is disabled by default except when parsing Maven POMs where the default is to allow DTD processing but only to include a DTD snippet shipping with Ivy that is needed to deal with existing Maven POMs that are not valid XML files but are nevertheless accepted by Maven. Access can be be made more lenient via newly introduced system properties where needed. Users of Ivy prior to version 2.5.2 can use Java system properties to restrict processing of external DTDs, see the section about "JAXP Properties for External Access restrictions" inside Oracle's "Java API for XML Processing (JAXP) Security Guide".
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (20)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2023/09/06/9cnnvd
- https://cxsecurity.com/cveshow/CVE-2022-46751/cnnvd
- https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-94ABC0EE-9DC8-44F0-84AD-47ADD5340477cnnvd
- https://gitbox.apache.org/repos/asf?p=ant-ivy.git;a=commit;h=2be17bc18b0e1d4123007d579e43ba1a4b6fab3dcnnvd
- https://lists.apache.org/thread/1dj60hg5nr36kjr4p1100dwjrqookps8cnnvd
- https://lists.apache.org/thread/9gcz4xrsn8c7o9gb377xfzvkb8jltffrcnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.5088cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.6459cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan