CVE-2022-23437

Published: Jan 24, 2022Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Affected (58)

Products: Apache: Xerces J · Oracle: Agile Engineering Data Management, Agile Plm, Banking Deposits And Lines Of Credit Servicing, Banking Party Management, Communications Asap, Communications Element Manager, Communications Session Report Manager, Communications Session Route Manager, Financial Services Analytical Applications Infrastructure, Financial Services Behavior Detection Platform, Financial Services Crime And Compliance Management Studio, Financial Services Enterprise Case Management, Flexcube Universal Banking, Global Lifecycle Management Nextgen Oui Framework, Global Lifecycle Management Opatch, Health Sciences Information Manager, Ilearning, Peoplesoft Enterprise Peopletools, Primavera Gateway, Product Lifecycle Analytics, Retail Bulk Data Integration, Retail Extract Transform And Load, Retail Financial Integration, Retail Integration Bus, Retail Merchandising System, Retail Service Backbone, Weblogic Server · Netapp: Active Iq Unified Manager

Apache

1 product

Xerces J

Oracle

27 products

Agile Engineering Data Management

Agile Plm

Banking Deposits And Lines Of Credit Servicing

Banking Party Management

Communications Asap

Communications Element Manager

Communications Session Report Manager

Communications Session Route Manager

Financial Services Analytical Applications Infrastructure

Financial Services Behavior Detection Platform

Financial Services Crime And Compliance Management Studio

Financial Services Enterprise Case Management

Flexcube Universal Banking

Global Lifecycle Management Nextgen Oui Framework

Global Lifecycle Management Opatch

Health Sciences Information Manager

Ilearning

Peoplesoft Enterprise Peopletools

Primavera Gateway

Product Lifecycle Analytics

Retail Bulk Data Integration

Retail Extract Transform And Load

Retail Financial Integration

Retail Integration Bus

Retail Merchandising System

Retail Service Backbone

Weblogic Server

Netapp

1 product

Active Iq Unified Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Xerces J	Up to 2.12.1

Configuration B

56 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Engineering Data Management	Version 6.2.1.0
Oracle Agile Plm	Version 9.3.6
Oracle Banking Deposits And Lines Of Credit Servicing	Version 2.7
Oracle Banking Party Management	Version 2.7.0
Oracle Communications Asap	Version 7.3
Oracle Communications Element Manager	Before 9.0
Oracle Communications Session Report Manager	Before 9.0
Oracle Communications Session Route Manager	Before 9.0
Oracle Financial Services Analytical Applications Infrastructure	From 8.0.6.0.0 to 8.0.9.0
Oracle Financial Services Analytical Applications Infrastructure	From 8.1.0.0 to 8.1.2.0
Oracle Financial Services Behavior Detection Platform	From 8.0.6.0.0 to 8.0.8.0
Oracle Financial Services Behavior Detection Platform	Version 8.1.1.0
Oracle Financial Services Behavior Detection Platform	Version 8.1.1.1
Oracle Financial Services Behavior Detection Platform	Version 8.1.2.0
Oracle Financial Services Crime And Compliance Management Studio	Version 8.0.8.2.0
Oracle Financial Services Crime And Compliance Management Studio	Version 8.0.8.3.0
Oracle Financial Services Enterprise Case Management	Version 8.0.7.1
Oracle Financial Services Enterprise Case Management	Version 8.0.7.2.0
Oracle Financial Services Enterprise Case Management	Version 8.0.8.0
Oracle Financial Services Enterprise Case Management	Version 8.0.8.1
Oracle Financial Services Enterprise Case Management	Version 8.1.1.0
Oracle Financial Services Enterprise Case Management	Version 8.1.1.1
Oracle Flexcube Universal Banking	Version 12.4.0
Oracle Global Lifecycle Management Nextgen Oui Framework	Before 13.9.4.2.2
Oracle Global Lifecycle Management Nextgen Oui Framework	Version 13.9.4.2.2
Oracle Global Lifecycle Management Opatch	Before 12.2.0.1.30
Oracle Health Sciences Information Manager	From 3.0.1 to 3.0.5
Oracle Health Sciences Information Manager	Version 3.0.0.1
Oracle Ilearning	Version 6.2
Oracle Ilearning	Version 6.3
Oracle Peoplesoft Enterprise Peopletools	Version 8.58
Oracle Peoplesoft Enterprise Peopletools	Version 8.59
Oracle Primavera Gateway	From 17.7 to 17.12.11
Oracle Primavera Gateway	From 18.8.0 to 18.8.14
Oracle Primavera Gateway	From 19.12.0 to 19.12.13
Oracle Primavera Gateway	From 20.12.0 to 20.12.8
Oracle Product Lifecycle Analytics	Version 3.6.1
Oracle Retail Bulk Data Integration	Version 16.0.3.0
Oracle Retail Extract Transform And Load	Version 13.2.8
Oracle Retail Financial Integration	Version 14.1.3.2
Oracle Retail Financial Integration	Version 15.0.3.1
Oracle Retail Financial Integration	Version 16.0.3
Oracle Retail Financial Integration	Version 19.0.1
Oracle Retail Integration Bus	Version 14.1.3.2
Oracle Retail Integration Bus	Version 15.0.3.1
Oracle Retail Integration Bus	Version 16.0.3
Oracle Retail Integration Bus	Version 19.0.1
Oracle Retail Merchandising System	Version 16.0.3
Oracle Retail Merchandising System	Version 19.0.1
Oracle Retail Service Backbone	Version 14.1.3.2
Oracle Retail Service Backbone	Version 15.0.3.1
Oracle Retail Service Backbone	Version 16.0.3
Oracle Retail Service Backbone	Version 19.0.1
Oracle Weblogic Server	Version 12.2.1.3.0
Oracle Weblogic Server	Version 12.2.1.4.0
Oracle Weblogic Server	Version 14.1.1.0.0