Skip to main content

XML Injection (aka Blind XPath Injection) in nokogiri

CVE-2022-23437

  • nokogiri
  • xerces:xerces
  • xerces:xercesImpl
  • xerces:xercesImpl-2.6.2-jaxb
Medium
6.5/10

Summary

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • REQUIRED
  • NONE
  • NONE
  • HIGH

CWE-91 - XML Injection (aka Blind XPath Injection)

The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

References

Advisory Timeline

  • Published