What is GHSA-jvfv-hrrc-6q72?

GHSA-jvfv-hrrc-6q72 is a security advisory published by GitHub Security Advisories with Critical severity. Improper Restriction of XML External Entity Reference in Liquibase

Which CVE IDs does GHSA-jvfv-hrrc-6q72 cover?

GHSA-jvfv-hrrc-6q72 covers the following CVE IDs: CVE-2022-0839. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jvfv-hrrc-6q72?

GHSA-jvfv-hrrc-6q72 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-jvfv-hrrc-6q72?

GHSA-jvfv-hrrc-6q72 affects 1 product, including: maven/org.liquibase:liquibase-core:\u003c 4.8.0.

GHSA-jvfv-hrrc-6q72CriticalCVSS 9.8

Improper Restriction of XML External Entity Reference in Liquibase

Vendor

GitHub Security Advisories

Published

March 5, 2022

Last Modified

November 3, 2025

🔗 CVE IDs covered (1)

CVE-2022-0839 →

📋 Description

The XMLChangeLogSAXParser() function in Liquibase prior to version 4.8.0 contains an issue that may lead to to Improper Restriction of XML External Entity Reference.

🎯 Affected products1

maven/org.liquibase:liquibase-core:< 4.8.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2022-0839
https://github.com/liquibase/liquibase/commit/33d9d925082097fb1a3d2fc8e44423d964cd9381
https://huntr.dev/bounties/f1ae5779-b406-4594-a8a3-d089c68d6e70
https://www.oracle.com/security-alerts/cpujul2022.html
http://seclists.org/fulldisclosure/2025/Apr/14
https://github.com/advisories/GHSA-jvfv-hrrc-6q72