{"id":"GHSA-wrx5-rp7m-mm49","summary":"Withdrawn: CVE Rejected: JXPath vulnerable to remote code execution when interpreting untrusted XPath expressions","details":"## This advisory has been withdrawn due to the CVE being rejected.\n\n## Original advisory text\nThose using JXPath to interpret untrusted XPath expressions may be vulnerable to a remote code execution attack. All JXPathContext class functions processing a XPath string are vulnerable except `compile()` and `compilePath()` function. The XPath expression can be used by an attacker to load any Java class from the classpath resulting in code execution.","aliases":["CVE-2022-41852"],"modified":"2026-09-10T03:49:46.767583Z","published":"2022-10-06T18:52:05Z","withdrawn":"2023-03-06T22:41:22Z","database_specific":{"cwe_ids":["CWE-470"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2022-10-06T20:35:33Z","nvd_published_at":"2022-10-06T18:17:00Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41852"},{"type":"WEB","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47133"},{"type":"WEB","url":"https://commons.apache.org/proper/commons-jxpath/users-guide.html#Standard_Extension_Functions"},{"type":"PACKAGE","url":"https://github.com/apache/commons-jxpath"},{"type":"WEB","url":"https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852"}],"affected":[{"package":{"name":"commons-jxpath:commons-jxpath","ecosystem":"Maven","purl":"pkg:maven/commons-jxpath/commons-jxpath"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3"}]}],"versions":["1.0","1.1","1.2","1.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-wrx5-rp7m-mm49/GHSA-wrx5-rp7m-mm49.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}