Maven package
org.apache.ivy/ivy
pkg:maven/org.apache.ivy/ivy
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-46751 | — | < 2.5.2 | 2.5.2 | Aug 21, 2023 | Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own c | ||
| CVE-2022-37866 | — | >= 2.0.0, < 2.5.1 | 2.5.1 | Nov 7, 2022 | When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain "../" sequences - which a | ||
| CVE-2022-37865 | — | >= 2.4.0, < 2.5.1 | 2.5.1 | Nov 7, 2022 | With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the target path when extracti |
- CVE-2022-46751Aug 21, 2023affected < 2.5.2fixed 2.5.2
Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own c
- CVE-2022-37866Nov 7, 2022affected >= 2.0.0, < 2.5.1fixed 2.5.1
When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain "../" sequences - which a
- CVE-2022-37865Nov 7, 2022affected >= 2.4.0, < 2.5.1fixed 2.5.1
With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the target path when extracti