CVE-2022-23437

MediumCVSS 6.5/10Last modified Oct 8, 2026

Description

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

No affected versions have been published.

Timeline

Published: Jan 24, 2022
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-234386.1An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in FortiOS version 7.0.5 and CVE-2022-234396.1A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafte CVE-2022-23447.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045.CVE-2022-234407.8A use of hard-coded cryptographic key vulnerability [CWE-321] in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.CVE-2022-234419.1A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiEDR versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow an unauthenticated a CVE-2022-234424.3An improper access control vulnerability [CWE-284] in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.0.0 through 7.0.5 may CVE-2022-234437.5An improper access control in Fortinet FortiSOAR before 7.2.0 allows unauthenticated attackers to access gateway API data via crafted HTTP G CVE-2022-234464.4A improper control of a resource through its lifetime in Fortinet FortiEDR version 5.0.3 and earlier allows attacker to make the whole appli CVE-2022-234477.5An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiExtender management interfa CVE-2022-234487.8A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions CVE-2022-234497.3A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions CVE-2022-23457.8Use After Free in GitHub repository vim/vim prior to 9.0.0046.