| Title | Apache Xerces Java XML パーサにおけるブラインド XPath インジェクションの脆弱性 |
|---|---|
| Summary | Apache Xerces Java (XercesJ) XML パーサには、ブラインド XPath インジェクションの脆弱性が存在します。 |
| Possible impacts | サービス運用妨害 (DoS) 状態にされる可能性があります。 |
| Solution | ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date | Jan. 24, 2022, midnight |
| Registration Date | Sept. 7, 2022, 3:42 p.m. |
| Last Update | May 16, 2025, 5:40 p.m. |
| CVSS3.0 : 警告 | |
| Score | 6.5 |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| CVSS2.0 : 危険 | |
| Score | 7.1 |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:N/I:N/A:C |
| Apache Software Foundation |
| Apache Xerces2 Java 2.12.1 およびそれ以前 |
| オラクル |
| Communications Session Route Manager |
| Oracle Communications Session Element Manager |
| Oracle Communications Session Report Manager |
| Oracle Financial Services Analytical Applications Infrastructure |
| Oracle Financial Services Behavior Detection Platform |
| Oracle Financial Services Enterprise Case Management |
| Oracle iLearning |
| Oracle Retail Bulk Data Integration |
| Oracle Retail Extract Transform and Load |
| Oracle Retail Financial Integration |
| 日立 |
| Cosminexus XML Processor |
| Hitachi Ops Center Common Services |
| JP1/Automatic Operation |
| JP1/IT Desktop Management 2 - Manager |
| JP1/IT Desktop Management 2 - Operations Director |
| JP1/Operations Analytics |
| uCosminexus Application Server |
| uCosminexus Application Server Enterprise |
| uCosminexus Application Server Enterprise Custom Edition |
| uCosminexus Application Server Express |
| uCosminexus Application Server Light |
| uCosminexus Application Server Smart Edition |
| uCosminexus Application Server Standard |
| uCosminexus Application Server Standard Custom Edition |
| uCosminexus Application Server Standard-R |
| uCosminexus Application Server(64) |
| uCosminexus Application Server-R |
| uCosminexus Client |
| uCosminexus Client for ATM |
| uCosminexus Client for Plug-in |
| uCosminexus Developer |
| uCosminexus Developer 01 |
| uCosminexus Developer Light |
| uCosminexus Developer Professional |
| uCosminexus Developer Professional for ATM |
| uCosminexus Developer Professional for Plug-in |
| uCosminexus Developer Standard |
| uCosminexus Operator |
| uCosminexus Operator for Service Platform |
| uCosminexus Primary Server Base |
| uCosminexus Primary Server Base(64) |
| uCosminexus Service Architect |
| uCosminexus Service Platform |
| uCosminexus Service Platform(64) |
| プログラミング環境 for Java |
| No | Changed Details | Date of change |
|---|---|---|
| 3 | [2023年08月09日] 影響を受けるシステム：ベンダ情報 (hitachi-sec-2022-129) の更新に伴い内容を更新 |
Aug. 9, 2023, 3:36 p.m. |
| 4 | [2025年04月23日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新 ベンダ情報：日立 (hitachi-sec-2025-114) を追加 |
April 23, 2025, 10:56 a.m. |
| 1 | [2022年09月07日] 掲載 | Sept. 7, 2022, 2:35 p.m. |
| 2 | [2022年11月02日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新 ベンダ情報：日立 (hitachi-sec-2022-136) を追加 |
Nov. 2, 2022, 4:17 p.m. |
| 5 | [2025年05月16日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新 ベンダ情報：日立 (hitachi-sec-2025-119) を追加 |
May 16, 2025, 3:20 p.m. |
| Summary | There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions. |
|---|---|
| Publication Date | Jan. 25, 2022, 12:15 a.m. |
| Registration Date | Jan. 25, 2022, 10 a.m. |
| Last Update | Nov. 21, 2024, 3:48 p.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:apache:xerces-j:*:*:*:*:*:*:*:* | 2.12.1 | ||||
| Configuration2 | or higher | or less | more than | less than | |
| cpe:2.3:a:oracle:ilearning:6.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:flexcube_universal_banking:12.4.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:13.9.4.2.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:retail_service_backbone:16.0.3:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:retail_financial_integration:16.0.3:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:retail_integration_bus:16.0.3:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:retail_service_backbone:15.0.3.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.2.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.8:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:retail_integration_bus:15.0.3.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:retail_financial_integration:15.0.3.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:communications_asap:7.3:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:ilearning:6.3:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:retail_service_backbone:19.0.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:retail_integration_bus:19.0.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:retail_financial_integration:19.0.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:* | 9.0 | ||||
| cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* | 8.0.6.0.0 | 8.0.9.0 | |||
| cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* | 9.0 | ||||
| cpe:2.3:a:oracle:financial_services_behavior_detection_platform:*:*:*:*:*:*:*:* | 8.0.6.0.0 | 8.0.8.0 | |||
| cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* | 8.1.0.0 | 8.1.2.0 | |||
| cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* | 9.0 | ||||
| cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:*:*:*:*:*:*:*:* | 13.9.4.2.2 | ||||
| cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* | 19.12.0 | 19.12.13 | |||
| cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* | 18.8.0 | 18.8.14 | |||
| cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:* | 12.2.0.1.30 | ||||
| cpe:2.3:a:oracle:health_sciences_information_manager:*:*:*:*:*:*:*:* | 3.0.1 | 3.0.5 | |||
| cpe:2.3:a:oracle:health_sciences_information_manager:3.0.0.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:banking_deposits_and_lines_of_credit_servicing:2.7:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* | 20.12.0 | 20.12.8 | |||
| cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* | 17.7 | 17.12.11 | |||
| Configuration3 | or higher | or less | more than | less than | |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | |||||