Critical severity · published Dec 27, 2022
CVE-2022-4725
A vulnerability was found in AWS SDK 2.59.0
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java of the component XML Parser. The manipulation leads to server-side request forgery. Upgrading to version 2.59.1 is able to address this issue. The name of the patch is c3e6d69422e1f0c80fe53f2d757b8df97619af2b. It is recommended to upgrade the affected component. The identifier VDB-216737 was assigned to this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Aws Software Development Kit · Amazon
before 2.59.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-4725
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-4725
Patch
https://github.com/aws-amplify/aws-sdk-android/commit/c3e6d69422e1f0c80fe53f2d757b8df97619af2b
Patch
https://github.com/aws-amplify/aws-sdk-android/pull/3100
Release Notes
https://github.com/aws-amplify/aws-sdk-android/releases/tag/release_v2.59.1
Third Party Advisory
https://vuldb.com/?id.216737
More from Aws Software Development Kit
7.2
CVE-2018-19981
Amazon AWS SDK <=2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito Identity Service
5.9
CVE-2026-19642
Out-of-bounds write in the Base64 decoder in Amazon aws-sdk-cpp
5.3
CVE-2026-19643
Out-of-bounds read in the Base64 decoder in Amazon aws-sdk-cpp on signed-char platforms
4.3
CVE-2022-2582
The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field
3.3
CVE-2023-51651
AWS SDK for PHP is the Amazon Web Services software development kit for PHP