Apache ANY23 vulnerabilities

4 CVEs affecting Apache ANY23, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-34150, published 2023-07-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-40146, published 2021-09-11. Critical severity, CVSS 9.8. EPSS: 5.7% chance of exploitation in the next 30 days. A Remote Code Execution (RCE) vulnerability was discovered in the Any23 YAMLExtractor.java file and is known to affect Any23 versions < 2.5. RCE vulnerabilities allow a malicious actor to execute any…
CVE-2022-25312, published 2022-03-05. Critical severity, CVSS 9.1. EPSS: 2.9% chance of exploitation in the next 30 days. An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML external entity injection (also known…
CVE-2021-38555, published 2021-09-11. Critical severity, CVSS 9.1. EPSS: 2.8% chance of exploitation in the next 30 days. An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML external entity injection (also known as XXE)…
CVE-2023-34150, published 2023-07-05. Medium severity, CVSS 5.3. EPSS: 1.5% chance of exploitation in the next 30 days. ** UNSUPPORTED WHEN ASSIGNED ** Use of TikaEncodingDetector in Apache Any23 can cause excessive memory usage.