Login Request a demo
High severity · published Jul 19, 2022
CVE-2022-34169
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
7.5
CVSS
81.8%
EPSS
No
On KEV
Description
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)81.8% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
7T
7-mode Transition Tool · Netapp
All versions, or not specified · source: NVD
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
CI
Cloud Insights Acquisition Unit · Netapp
All versions, or not specified · source: NVD
CS
Cloud Secure Agent · Netapp
All versions, or not specified · source: NVD
DL
Debian Linux · Debian
10.0; 11.0 · source: NVD
FE
Fedora · Fedoraproject
35; 36 · source: NVD
GR
Graalvm · Oracle
20.3.6; 21.3.2; 22.1.0 · source: NVD
HC
Hci Compute Node · Netapp
All versions, or not specified · source: NVD
HM
Hci Management Node · Netapp
All versions, or not specified · source: NVD
JD
Jdk · Oracle
1.7.0; 1.8.0; 11.0.15.1; 17.0.3.1; 18.0.1.1 · source: NVD
JR
Jre · Oracle
1.7.0; 1.8.0; 11.0.15.1; 17.0.3.1; 18.0.1.1 · source: NVD
OI
Oncommand Insight · Netapp
All versions, or not specified · source: NVD
Affected product
XA
Xalan-java
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-34169
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-34169
Third Party Advisory
http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html
Mailing List
http://www.openwall.com/lists/oss-security/2022/07/19/5
Mailing List
http://www.openwall.com/lists/oss-security/2022/07/19/6
Mailing List
http://www.openwall.com/lists/oss-security/2022/07/20/2
Mailing List
http://www.openwall.com/lists/oss-security/2022/07/20/3
Mailing List
http://www.openwall.com/lists/oss-security/2022/10/18/2
More from Xalan-java
–
CVE-2014-0107
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote…