What’s Vulnerable › Vulnerabilities
CVE-2022-2838
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-08-16 · updated 2026-06-17
- Weakness: CWE-611
Description
In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection of arbitrary definitions which is able to access local files and expose their contents via HTTP requests.
Affected products
- The Eclipse Foundation Eclipse Sphinx: from 0.7.0 before 0.13.1 — fixed in 0.13.1
How to fix
Upgrade to a fixed version: The Eclipse Foundation Eclipse Sphinx 0.13.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2022-2838 or the next vulnerability affects your stack