Lucene search

[email protected]CVE-2022-47514

HistoryDec 18, 2022 - 4:15 a.m.

CVE-2022-47514

2022-12-1804:15:09

CWE-611

[email protected]

web.nvd.nist.gov

cve

xml

xxe

injection vulnerability

ssrf

pingback

server-side request forgery

nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.2%

JSON

An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, as demonstrated by a pingback.aspx POST request.

Affected configurations

NVD

Node

xml-rpc.net_projectxml-rpc.netRange<2.5.0

CPENameOperatorVersion
xml-rpc.net_project:xml-rpc.netxml-rpc.net project xml-rpc.netlt2.5.0

CPE	Name	Operator	Version
xml-rpc.net_project:xml-rpc.net	xml-rpc.net project xml-rpc.net	lt	2.5.0

References

github.com/jumpycastle/xmlrpc.net-poc

papercutsoftware.github.io/XML-RPC.NET/download.html

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.2%

JSON

Related for CVE-2022-47514

cvelist1 prion1 nvd1