Severity
High
Analysis Summary
CVE-2022-46751
Apache Ivy could allow a remote attacker to obtain sensitive information, caused by improper handling of XML external entity (XXE) declarations by the XML parser. By using a specially crafted XML content, a remote attacker could exploit this vulnerability to exfiltrate data, access resources only the machine running Ivy has access to or disturb the execution of Ivy.
Impact
- Information Disclosure
Indicators Of Compromise
CVE
- CVE-2022-46751
Affected Vendors
Apache
Affected Products
- Apache Ivy 1.0.0
- Apache Ivy 2.5.1
Remediation
Upgrade to the latest version of Apache Ivy, available from the Apache Web site.