Medium severity · published Jan 24, 2022
CVE-2022-23437
Infinite loop within Apache XercesJ xml parser
6.5
CVSS
11.6%
EPSS
No
On KEV
Description
There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)11.6% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
WebLogic Server · Oracle
12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0 · source: NVD
AX
Apache Xerces · Apache Software Foundation
Apache XercesJ through 2.12.1 · source: vendor
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
AE
Agile Engineering Data Management · Oracle
6.2.1.0 · source: NVD
AP
Agile Product Lifecycle Management · Oracle
9.3.6 · source: NVD
BD
Banking Deposits And Lines OF Credit Servicing · Oracle
2.7 · source: NVD
BP
Banking Party Management · Oracle
2.7.0 · source: NVD
CA
Communications Asap · Oracle
7.3 · source: NVD
CE
Communications Element Manager · Oracle
before 9.0 · source: NVD
CS
Communications Session Report Manager · Oracle
before 9.0 · source: NVD
CS
Communications Session Route Manager · Oracle
before 9.0 · source: NVD
FS
Financial Services Analytical Applications Infrastructure · Oracle
8.0.6.0.0 through 8.0.9.0; 8.1.0.0 before 8.1.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23437
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23437
Mailing List
http://www.openwall.com/lists/oss-security/2022/01/24/3
Mailing List
https://lists.apache.org/thread/6pjwm10bb69kq955fzr1n0nflnjd27dl
Third Party Advisory
https://security.netapp.com/advisory/ntap-20221028-0005/
Patch
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
https://www.oracle.com/security-alerts/cpujul2022.html
More from WebLogic Server
9.8
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
9.8
CVE-2020-14750
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14882
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14644
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-2883
Oracle WebLogic Server Unspecified Vulnerability