{
  "cveId": "CVE-2022-46751",
  "url": "https://patchblox.com/security/cve/CVE-2022-46751",
  "summary": "CVE-2022-46751 is fixed in 2 products on 1 platform, first by ALAS2023-2023-336, released August 31, 2023. It is not reported as exploited. Patch Radar priority: High.",
  "title": "apache-ivy: Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apa...",
  "description": "Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2.",
  "published": "2023-08-31T21:47:00Z",
  "severity": "important",
  "epss": 0.01999,
  "epssPercentile": 0.80909,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "apache-ivy",
      "release": "amzn 2023",
      "fixedVersion": "2.5.1-1.amzn2023.0.2",
      "fix": "ALAS2023-2023-336",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-336",
      "released": "2023-08-31T21:47:00Z"
    },
    {
      "platform": "linux",
      "product": "apache-ivy-javadoc",
      "release": "amzn 2023",
      "fixedVersion": "2.5.1-1.amzn2023.0.2",
      "fix": "ALAS2023-2023-336",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-336",
      "released": "2023-08-31T21:47:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-11T07:45:43Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}