CVE-2022-4725 : A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This

A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java of the component XML Parser. The manipulation leads to server-side request forgery. Upgrading to version 2.59.1 is able to address this issue. The name of the patch is c3e6d69422e1f0c80fe53f2d757b8df97619af2b. It is recommended to upgrade the affected component. The identifier VDB-216737 was assigned to this vulnerability.

Published 2022-12-27 15:15:12

Updated 2024-05-17 02:16:54

Source VulDB

View at NVD, CVE.org

Vulnerability category: Server-side request forgery (SSRF)

Products affected by CVE-2022-4725

Amazon » Aws Software Development Kit » For Android
Versions before (<) 2.59.1
cpe:2.3:a:amazon:aws_software_development_kit:*:*:*:*:*:android:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-4725

EPSS FAQ

0.20%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 58 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-4725

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.5	MEDIUM	CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	2.1	3.4	VulDB
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low
5.5	MEDIUM	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	2.1	3.4	VulDB	2024-02-29
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-4725

CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Assigned by: cna@vuldb.com (Primary)

References for CVE-2022-4725

https://github.com/aws-amplify/aws-sdk-android/pull/3100

fix(core): added fix for xml parser by banji180 · Pull Request #3100 · aws-amplify/aws-sdk-android · GitHub
Patch;Third Party Advisory
https://github.com/aws-amplify/aws-sdk-android/releases/tag/release_v2.59.1

Release AWS SDK for Android 2.59.1 · aws-amplify/aws-sdk-android · GitHub
Release Notes;Third Party Advisory
https://github.com/aws-amplify/aws-sdk-android/commit/c3e6d69422e1f0c80fe53f2d757b8df97619af2b

fix(core): added fix for xml parser (#3100) · aws-amplify/aws-sdk-android@c3e6d69 · GitHub
Patch;Third Party Advisory
https://vuldb.com/?id.216737

CVE-2022-4725 | AWS SDK XML Parser XpathUtils.java XpathUtils server-side request forgery (ID 3100)
Third Party Advisory

Jump to

Vulnerability Details : CVE-2022-4725

Products affected by CVE-2022-4725

Exploit prediction scoring system (EPSS) score for CVE-2022-4725

CVSS scores for CVE-2022-4725

CWE ids for CVE-2022-4725

References for CVE-2022-4725