CVE-2022-23437: xerces-j through 2.12.1 (inclusive); +29 more affected products

Affected technology

xerces-j · through 2.12.1 (inclusive)
apache

agile engineering data management · 6.2.1.0
oracle

agile product lifecycle management · 9.3.6
oracle

banking deposits and lines of credit servicing · 2.7
oracle

banking party management · 2.7.0
oracle

communications asap · 7.3
oracle

communications element manager · before 9.0 (exclusive)
oracle

communications session report manager · before 9.0 (exclusive)
oracle

communications session route manager · before 9.0 (exclusive)
oracle

financial services analytical applications infrastructure · from 8.0.6.0.0 (inclusive), through 8.0.9.0 (inclusive)
oracle

financial services analytical applications infrastructure · from 8.1.0.0 (inclusive), before 8.1.2.0 (exclusive)
oracle

financial services behavior detection platform · from 8.0.6.0.0 (inclusive), through 8.0.8.0 (inclusive)
oracle

financial services behavior detection platform · 8.1.1.0
oracle

financial services behavior detection platform · 8.1.1.1
oracle

financial services behavior detection platform · 8.1.2.0
oracle

financial services crime and compliance management studio · 8.0.8.2.0
oracle

financial services crime and compliance management studio · 8.0.8.3.0
oracle

financial services enterprise case management · 8.0.7.1
oracle

financial services enterprise case management · 8.0.7.2.0
oracle

financial services enterprise case management · 8.0.8.0
oracle

financial services enterprise case management · 8.0.8.1
oracle

financial services enterprise case management · 8.1.1.0
oracle

financial services enterprise case management · 8.1.1.1
oracle

flexcube universal banking · 12.4.0
oracle

global lifecycle management nextgen oui framework · before 13.9.4.2.2 (exclusive)
oracle

global lifecycle management nextgen oui framework · 13.9.4.2.2
oracle

global lifecycle management opatch · before 12.2.0.1.30 (exclusive)
oracle

health sciences information manager · from 3.0.1 (inclusive), through 3.0.5 (inclusive)
oracle

health sciences information manager · 3.0.0.1
oracle

ilearning · 6.2
oracle

ilearning · 6.3
oracle

peoplesoft enterprise peopletools · 8.58
oracle

peoplesoft enterprise peopletools · 8.59
oracle

primavera gateway · from 17.7 (inclusive), through 17.12.11 (inclusive)
oracle

primavera gateway · from 18.8.0 (inclusive), through 18.8.14 (inclusive)
oracle

primavera gateway · from 19.12.0 (inclusive), through 19.12.13 (inclusive)
oracle

primavera gateway · from 20.12.0 (inclusive), through 20.12.8 (inclusive)
oracle

product lifecycle analytics · 3.6.1
oracle

retail bulk data integration · 16.0.3.0
oracle

retail extract transform and load · 13.2.8
oracle

retail financial integration · 14.1.3.2
oracle

retail financial integration · 15.0.3.1
oracle

retail financial integration · 16.0.3
oracle

retail financial integration · 19.0.1
oracle

retail integration bus · 14.1.3.2
oracle

retail integration bus · 15.0.3.1
oracle

retail integration bus · 16.0.3
oracle

retail integration bus · 19.0.1
oracle

retail merchandising system · 16.0.3
oracle

retail merchandising system · 19.0.1
oracle

retail service backbone · 14.1.3.2
oracle

retail service backbone · 15.0.3.1
oracle

retail service backbone · 16.0.3
oracle

retail service backbone · 19.0.1
oracle

weblogic server · 12.2.1.3.0
oracle

weblogic server · 12.2.1.4.0
oracle

weblogic server · 14.1.1.0.0
oracle

active iq unified manager · Version not applicable in the source CPE
netapp

Apache Xerces · Apache XercesJ through 2.12.1
Apache Software Foundation

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

NVD’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.