Lucene search
HistorySep 13, 2022 - 8:15 p.m.
CVE-2022-38342
safe software fme server
v2021.2.5
v2022.0.0.2
xml external entity
xxe vulnerability
authenticated attackers
data exfiltration
server-side request forgery
ssrf attacks
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
28.4%
Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a XML External Entity (XXE) vulnerability which allows authenticated attackers to perform data exfiltration or Server-Side Request Forgery (SSRF) attacks.
Affected configurations
Node
safefme_serverRange<2021.2.6.0
ORsafefme_serverRange2022.0.0.0–2022.0.0.2
Related
prion
prion
Server side request forgery (ssrf)
2022-09-13 20:15:00
cve
cve
CVE-2022-38342
2022-09-13 20:15:09
cvelist
cvelist
CVE-2022-38342
2022-09-13 00:00:00
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
28.4%
Related for NVD:CVE-2022-38342