Cocoon vulnerabilities

3 known vulnerabilities in Cocoon from Apache. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Apache Cocoon: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

  CVE-2025-24783Jan 27, 2025Apache

  ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. When a continuation is created, it gets a random identifier. Because the random nu

• 9.8 Critical severity

  Apache Cocoon: Improper Restriction of XML External Entity Reference

  CVE-2023-49733Nov 30, 2023ApacheEPSS 1.29%

  Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue.

• 9.8 Critical severity

  Apache Cocoon: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2022-45135Nov 30, 2023ApacheEPSS 1.1%

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue.