CVE-2022-2414

2022-07-2919:15:08

Debian Security Bug Tracker

security-tracker.debian.org

xml parsing

xxe attacks

remote attacker

http requests

arbitrary files

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.036

Percentile

91.7%

JSON

Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.

OSVersionArchitecturePackageVersionFilename
Debian11alldogtag-pki<= 10.10.2-3dogtag-pki_10.10.2-3_all.deb
Debian999alldogtag-pki< 11.0.6-1dogtag-pki_11.0.6-1_all.deb