CVEvulnerability

CVE-2022-0217

7.5 HIGH Published 2022-08-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-08-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-611, CWE-776

Description

It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).

Affected configurations

• prosody prosody (< 0.11.12)

Related

Weakness · CWE (2)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness
  • CWE-776 Improper Restriction of Recursive Entity References in DTDs weakness

References