What’s Vulnerable › Vulnerabilities

CVE-2022-45470: Apache Hama allows XSS and information disclosure

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-11-21 · updated 2026-06-17
• Weakness: CWE-20

Description

missing input validation in Apache Hama may cause information disclosure through path traversal and XSS. Since Apache Hama is EOL, we do not expect these issues to be fixed.

Affected products

• Apache Software Foundation Apache Hama: through 1.7.1

References

• http://www.openwall.com/lists/oss-security/2022/11/21/1
• https://lists.apache.org/thread/ztvoshd4kxvp5vlro52mpgpfxct4ft8l
• http://www.openwall.com/lists/oss-security/2022/11/21/1
• https://lists.apache.org/thread/ztvoshd4kxvp5vlro52mpgpfxct4ft8l

Get alerted when CVE-2022-45470 or the next vulnerability affects your stack