CVE-2022-45135: Apache Cocoon SQL Injection vulnerability
Summary
CVE-2022-45135: Apache Cocoon SQL Injection vulnerability. Affects org.apache.cocoon:cocoon versions >= 2.2.0, < 2.3.0. Fixed in 2.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Cocoon is an open-source web development framework that focuses on XML and web services. It provides a robust environment for building dynamic web applications. However, versions of Apache Cocoon from 2.2.0 to 2.3.0 are vulnerable to an SQL Injection attack.
Vulnerability Detail
The vulnerability, known as 'Improper Neutralization of Special Elements used in an SQL Command,' allows an attacker to inject malicious SQL code into a query, potentially leading to unauthorized access, data manipulation, or data leakage. This vulnerability affects Apache Cocoon versions 2.2.0 to 2.3.0.
How To Fix
Latest published version: 9 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of Apache Cocoon as soon as possible.
Conclusion
The Apache Cocoon SQL Injection vulnerability (CVE-2022-45135) poses a risk to the security of web applications built using affected versions of Apache Cocoon. To mitigate this vulnerability, it is crucial to upgrade to Apache Cocoon version 2.3.0 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cocoon:cocoon →
FAQ
Apache Cocoon is an open-source web development framework that focuses on XML and web services. It provides a robust environment for building dynamic web applications.
SQL Injection is a type of security vulnerability that allows an attacker to manipulate SQL queries by injecting malicious code. This can lead to unauthorized access, data manipulation, or data leakage.
Versions of Apache Cocoon from 2.2.0 to 2.3.0 are affected by this SQL Injection vulnerability.
To fix this vulnerability, you should upgrade your Apache Cocoon installation to version 2.3.0 or later.
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of Apache Cocoon.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cocoon:cocoon.
