CVE-2022-28890

Published: May 5, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.

Affected (1)

Products: Apache: Jena

Apache

1 product

Jena

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Jena	Version 4.4.0

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

Timeline

No history available yet.