CVE-2022-2838: Improper Restriction of XML External Entity Reference

August 16, 2022 (updated November 9, 2023)

In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection of arbitrary definitions which is able to access local files and expose their contents via HTTP requests.

References

bugs.eclipse.org/580542
nvd.nist.gov/vuln/detail/CVE-2022-2838

Code Behaviors & Features

Detect and mitigate CVE-2022-2838 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →