GHSA-m8gq-83gh-v42v

ghsaUSosv

XML External Entities Vulnerability in CVRF-CSAF-Converter

view advisory published 2022-03-16Licence: CC-BY-4.0

CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-27193US	medium5.5	0.69% (53rd)	—	2022-03-15
CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An atta…

references

External citations — patches, advisories, analysis.

https://github.com/csaf-tools/CVRF-CSAF-ConverterPACKAGE
https://github.com/csaf-tools/CVRF-CSAF-Converter/releases/tag/1.0.0-rc2WEB
https://nvd.nist.gov/vuln/detail/CVE-2022-27193ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan