What is CVE-2022-2838?

CVE-2022-2838 is a medium-severity vulnerability in Eclipse Sphinx, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 5.3/10. Published 2022-08-16.

How severe is CVE-2022-2838?

Medium severity. CVSS v3 base score is 5.3 out of 10.

XXE in Eclipse Sphinx

CVE-2022-2838

In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection of arbitrary definitions which is able to access local files and expose their contents via HTTP requests.

Vulnerability class: XXE (XML External Entity)

EPSS: 0.005 (38.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Eclipse Sphinx
The Eclipse Foundation Sphinx — versions 0.7.0, unspecified

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

emo@eclipse.org (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2022-2838?: CVE-2022-2838 is a medium-severity vulnerability in Eclipse Sphinx, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 5.3/10. Published 2022-08-16.
How severe is CVE-2022-2838?: Medium severity. CVSS v3 base score is 5.3 out of 10.