PT-2022-5014 · Apache · Apache Commons Jxpath

Published 2022-10-06 · Updated 2025-08-25 · CVE-2022-41852

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Commons JXPath (affected versions not specified) GeoServer versions prior to 2.23.6, 2.24.4, and 2.25.2 hermes-management versions prior to 2.2.9

Description The issue is related to the application of external input for class selection in the JXPathContext class functions of the JXPath library, except for the compile() and compilePath() functions. This can allow a remote attacker to execute arbitrary code by loading any Java class from the classpath using an XPath expression. The vulnerability can be exploited through various requests, including WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic, and WPS Execute requests.

Recommendations For Apache Commons JXPath, consider disabling the vulnerable JXPathContext class functions until a patch is available. For GeoServer, upgrade to versions 2.23.6, 2.24.4, or 2.25.2, or remove the gt-complex-x.y.jar file from the GeoServer installation as a temporary workaround. For hermes-management, upgrade to at least version 2.2.9.

Exploit

Fix

Eval Injection

Code Injection

Weakness Enumeration

CWE-470

CWE-95

CWE-94

CWE-1395

Related Identifiers

BDU:2022-06227

CVE-2022-41852

GHSA-2GH6-WC3M-G37F

GHSA-6JJ6-GM7P-FCVV

GHSA-W3PJ-WH35-FQ8W

GHSA-WRX5-RP7M-MM49

Affected Products

Apache Commons Jxpath

References · 50

• 🔥 https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852 · Exploit
• 🔥 https://github.com/Warxim/CVE-2022-41852 · Exploit
• 🔥 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47133 · Exploit
• https://osv.dev/vulnerability/GHSA-w3pj-wh35-fq8w · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-41852 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36404 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-41852 · Security Note
• https://bdu.fstec.ru/vul/2022-06227 · Security Note
• https://osv.dev/vulnerability/GHSA-6jj6-gm7p-fcvv · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wrx5-rp7m-mm49 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41852 · Security Note
• https://ubuntu.com/security/CVE-2022-41852 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36401 · Security Note
• https://osv.dev/vulnerability/GHSA-2gh6-wc3m-g37f · Vendor Advisory
• https://github.com/geoserver/geoserver · Note