What is the CVSS score of CVE-2022-34169?

CVE-2022-34169 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 11.0%.

Is there a public PoC exploit available for CVE-2022-34169?

Yes, a public proof-of-concept exploit is available for CVE-2022-34169. Prioritise patching immediately. EPSS: 11.0%.

Is there a patch available for CVE-2022-34169?

Yes, a patch is available for CVE-2022-34169. Update the affected software to the latest version immediately.

Java CVE-2022-34169

HIGH

Incorrect Conversion between Numeric Types (CWE-681)

2022-07-19 security@apache.org

Apache RCE Java Xalan Java Debian Linux Graalvm Jdk Jre Openjdk Fedora 7 Mode Transition Tool Active Iq Unified Manager Cloud Insights Acquisition Unit Cloud Secure Agent Hci Management Node Oncommand Insight Solidfire Hci Compute Node Zulu

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Jul 19, 2022 - 18:15 cve.org

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

937 maven packages depend on xalan:xalan (82 direct, 858 indirect)

Ecosystem-wide dependent count for version 2.7.3.

DescriptionCVE.org

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

AnalysisAI

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 11.0%.

Technical ContextAI

This vulnerability is classified under CWE-681. The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan. Affected products include: Apache Xalan-Java, Debian Debian Linux, Oracle Graalvm, Oracle Jdk, Oracle Jre. Version information: version 2.7.3.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.