CVE-2022-2414

2022-07-2919:15:08

CWE-611

[email protected]

web.nvd.nist.gov

xml parsing

xxe attacks

remote attacker

http requests.

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.036

Percentile

91.7%

JSON

Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.

Affected configurations

Nvd

Node

dogtagpkidogtagpkiMatch10.5.18

dogtagpkidogtagpkiMatch10.7.4

dogtagpkidogtagpkiMatch10.8.3

dogtagpkidogtagpkiMatch10.11.2

dogtagpkidogtagpkiMatch10.12.4

dogtagpkidogtagpkiMatch11.0.5

dogtagpkidogtagpkiMatch11.1.0

VendorProductVersionCPE
dogtagpkidogtagpki10.5.18cpe:2.3:a:dogtagpki:dogtagpki:10.5.18:*:*:*:*:*:*:*
dogtagpkidogtagpki10.7.4cpe:2.3:a:dogtagpki:dogtagpki:10.7.4:*:*:*:*:*:*:*
dogtagpkidogtagpki10.8.3cpe:2.3:a:dogtagpki:dogtagpki:10.8.3:*:*:*:*:*:*:*
dogtagpkidogtagpki10.11.2cpe:2.3:a:dogtagpki:dogtagpki:10.11.2:*:*:*:*:*:*:*
dogtagpkidogtagpki10.12.4cpe:2.3:a:dogtagpki:dogtagpki:10.12.4:*:*:*:*:*:*:*
dogtagpkidogtagpki11.0.5cpe:2.3:a:dogtagpki:dogtagpki:11.0.5:*:*:*:*:*:*:*
dogtagpkidogtagpki11.1.0cpe:2.3:a:dogtagpki:dogtagpki:11.1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dogtagpki	dogtagpki	10.5.18	cpe:2.3:a:dogtagpki:dogtagpki:10.5.18:::::::*
dogtagpki	dogtagpki	10.7.4	cpe:2.3:a:dogtagpki:dogtagpki:10.7.4:::::::*
dogtagpki	dogtagpki	10.8.3	cpe:2.3:a:dogtagpki:dogtagpki:10.8.3:::::::*
dogtagpki	dogtagpki	10.11.2	cpe:2.3:a:dogtagpki:dogtagpki:10.11.2:::::::*
dogtagpki	dogtagpki	10.12.4	cpe:2.3:a:dogtagpki:dogtagpki:10.12.4:::::::*
dogtagpki	dogtagpki	11.0.5	cpe:2.3:a:dogtagpki:dogtagpki:11.0.5:::::::*
dogtagpki	dogtagpki	11.1.0	cpe:2.3:a:dogtagpki:dogtagpki:11.1.0:::::::*