CVE-2022-2838

5.3 mediumEPSS 0.5%

Medium (5.3) in eclipse sphinx. EPSS 0.5% chance of exploitation in the next 30 days.

In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection of arbitrary definitions which is able to access local files and expose their contents via HTTP requests.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2022-08-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

eclipse:sphinx

References

https://bugs.eclipse.org/580542
https://bugs.eclipse.org/580542

Check your stack JSON