Skip to content
OpenAdvisories

Package · Maven

org.apache.ivy:ivy

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.2
    CVE-2022-46751

    Apache Ivy: XML External Entity vulnerability in Apache Ivy

    Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML file…

    Apache Software Foundation Apache Ivy gradle-8 gradle-stage0 Wolfi Maven
  • High 7.5
    CVE-2022-37866

    Apache Ivy allows path traversal in the presence of a malicious repository

    When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain "../…

    Apache Software Foundation Apache Ivy gradle-stage0 org.apache.ivy:ivy Wolfi Maven
  • Critical 9.1
    CVE-2022-37865

    Apache Ivy allows creating/overwriting any file on the system

    With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the targ…

    Apache Software Foundation Apache Ivy org.apache.ivy:ivy Maven