What is CVE-2022-28890?

CVE-2022-28890 is a critical-severity vulnerability in Apache Jena, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 9.8/10. Published 2022-05-05.

How severe is CVE-2022-28890?

Critical severity. CVSS v3 base score is 9.8 out of 10.

XXE in Apache Jena

CVE-2022-28890

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.

Vulnerability class: XXE (XML External Entity)

EPSS: 0.025 (83.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Apache Jena — versions 4.4.0
Apache Software Foundation Jena — versions Apache Jena

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

security@apache.org (Mailing List, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2022-28890?: CVE-2022-28890 is a critical-severity vulnerability in Apache Jena, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 9.8/10. Published 2022-05-05.
How severe is CVE-2022-28890?: Critical severity. CVSS v3 base score is 9.8 out of 10.