PT-2022-14948 · Openkm · Openkm Community Edition

Name of the Vulnerable Software and Affected Versions: OpenKM Community Edition versions 6.3.10 and earlier Description: The issue allows an attacker to perform an XML external entity injection attack due to the use of the XMLReader parser in the XMLTextExtractor.java file without the required...

CVE-2022-2131: Improper Restriction of XML External Entity Reference

OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack...