VulnerabilityModified
CVE-2022-27193
CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE).
MEDIUM 5.5EPSS 0.69%
Does this matter?
Lower severity and a low EPSS score (0.69%). Track it; it rarely justifies an emergency change on its own.
Description
CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- EPSS
- 0.69% probability · 51th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-611
- Affected
- cvrf-csaf-converter project/cvrf-csaf-converter
- Source
- cve@mitre.org
References
- https://github.com/csaf-tools/CVRF-CSAF-Converter/releases/tag/1.0.0-rc2Third Party Advisory
- https://github.com/csaf-tools/CVRF-CSAF-Converter/releases/tag/1.0.0-rc2Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.