Lucene search

RedhatCVE-2022-2414

HistoryJul 29, 2022 - 7:15 p.m.

CVE-2022-2414

2022-07-2919:15:08

CWE-611

redhat

web.nvd.nist.gov

161

cve

2022

2414

xml

xxe

attacks

security

vulnerability

nvd

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.036

Percentile

91.7%

JSON

Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.

Affected configurations

Nvd

Vulners

Node

dogtagpkidogtagpkiMatch10.5.18

dogtagpkidogtagpkiMatch10.7.4

dogtagpkidogtagpkiMatch10.8.3

dogtagpkidogtagpkiMatch10.11.2

dogtagpkidogtagpkiMatch10.12.4

dogtagpkidogtagpkiMatch11.0.5

dogtagpkidogtagpkiMatch11.1.0

VendorProductVersionCPE
dogtagpkidogtagpki10.5.18cpe:2.3:a:dogtagpki:dogtagpki:10.5.18:*:*:*:*:*:*:*
dogtagpkidogtagpki10.7.4cpe:2.3:a:dogtagpki:dogtagpki:10.7.4:*:*:*:*:*:*:*
dogtagpkidogtagpki10.8.3cpe:2.3:a:dogtagpki:dogtagpki:10.8.3:*:*:*:*:*:*:*
dogtagpkidogtagpki10.11.2cpe:2.3:a:dogtagpki:dogtagpki:10.11.2:*:*:*:*:*:*:*
dogtagpkidogtagpki10.12.4cpe:2.3:a:dogtagpki:dogtagpki:10.12.4:*:*:*:*:*:*:*
dogtagpkidogtagpki11.0.5cpe:2.3:a:dogtagpki:dogtagpki:11.0.5:*:*:*:*:*:*:*
dogtagpkidogtagpki11.1.0cpe:2.3:a:dogtagpki:dogtagpki:11.1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dogtagpki	dogtagpki	10.5.18	cpe:2.3:a:dogtagpki:dogtagpki:10.5.18:::::::*
dogtagpki	dogtagpki	10.7.4	cpe:2.3:a:dogtagpki:dogtagpki:10.7.4:::::::*
dogtagpki	dogtagpki	10.8.3	cpe:2.3:a:dogtagpki:dogtagpki:10.8.3:::::::*
dogtagpki	dogtagpki	10.11.2	cpe:2.3:a:dogtagpki:dogtagpki:10.11.2:::::::*
dogtagpki	dogtagpki	10.12.4	cpe:2.3:a:dogtagpki:dogtagpki:10.12.4:::::::*
dogtagpki	dogtagpki	11.0.5	cpe:2.3:a:dogtagpki:dogtagpki:11.0.5:::::::*
dogtagpki	dogtagpki	11.1.0	cpe:2.3:a:dogtagpki:dogtagpki:11.1.0:::::::*

CNA Affected

[
  {
    "product": "Dogtag PKI",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Affected versions: 10.5.18, 10.7.4, 10.8.3, 10.11.2, 10.12.4, 11.0.5, 11.1.0"
      }
    ]
  }
]