CVE-2022-0839: 
Java vulnerability analysis and mitigation

An XML External Entity (XXE) vulnerability was discovered in GitHub repository liquibase/liquibase versions prior to 4.8.0, identified as CVE-2022-0839. The vulnerability was related to improper restriction of XML External Entity references in the XMLChangeLogSAXParser function (Oracle CPU, NVD).

The vulnerability stems from the XMLChangeLogSAXParser() function using SAXParser without the FEATURESECUREPROCESSING setting enabled. According to the Oracle Critical Patch Update, this vulnerability has a CVSS 3.1 Base Score of 5.0, with the vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N). The vulnerability requires local logon access and user interaction to be exploited (Oracle CPU).

If successfully exploited, this vulnerability could result in unauthorized access to critical data or complete access to all Oracle SQLcl (Liquibase) accessible data. The vulnerability affects the confidentiality of the system but does not impact integrity or availability (Oracle CPU).

The vulnerability was patched in Liquibase version 4.8.0. Users should upgrade to this version or later to mitigate the risk. A fix was also included in Oracle's July 2022 Critical Patch Update for affected Oracle products (Oracle CPU, CVE Mitre).