{
   affected: [
      {
         package: {
            ecosystem: "Maven",
            name: "commons-jxpath:commons-jxpath",
         },
         ranges: [
            {
               events: [
                  {
                     introduced: "0",
                  },
                  {
                     last_affected: "1.3",
                  },
               ],
               type: "ECOSYSTEM",
            },
         ],
      },
   ],
   aliases: [
      "CVE-2022-41852",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-470",
      ],
      github_reviewed: true,
      github_reviewed_at: "2022-10-06T20:35:33Z",
      nvd_published_at: "2022-10-06T18:17:00Z",
      severity: "CRITICAL",
   },
   details: "## This advisory has been withdrawn due to the CVE being rejected.\n\n## Original advisory text\nThose using JXPath to interpret untrusted XPath expressions may be vulnerable to a remote code execution attack. All JXPathContext class functions processing a XPath string are vulnerable except `compile()` and `compilePath()` function. The XPath expression can be used by an attacker to load any Java class from the classpath resulting in code execution.",
   id: "GHSA-wrx5-rp7m-mm49",
   modified: "2023-03-06T22:41:22Z",
   published: "2022-10-06T18:52:05Z",
   references: [
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2022-41852",
      },
      {
         type: "WEB",
         url: "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47133",
      },
      {
         type: "WEB",
         url: "https://commons.apache.org/proper/commons-jxpath/users-guide.html#Standard_Extension_Functions",
      },
      {
         type: "PACKAGE",
         url: "https://github.com/apache/commons-jxpath",
      },
      {
         type: "WEB",
         url: "https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
         type: "CVSS_V3",
      },
   ],
   summary: "Withdrawn: CVE Rejected: JXPath vulnerable to remote code execution when interpreting untrusted XPath expressions",
   withdrawn: "2023-03-06T22:41:22Z",
}