GitHub Advisoryadvisory · PyPI

GHSA-m8gq-83gh-v42v XML External Entities Vulnerability in CVRF-CSAF-Converter

MEDIUM Published 2022-03-16 Modified 2022-03-18 Official page ↗
Aliases
CVE-2022-27193
Ecosystem
PyPI
Packages
cvrf2csaf
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
Weaknesses
CWE-552, CWE-611
Reviewed
2022-03-18

Affected packages

• PyPI cvrf2csaf: < 1.0.0rc2 → fixed in 1.0.0rc2

Description

CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter.

Related

Alias · CVE (1)

  • CVE-2022-27193 CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). vulnerability

Weakness · CWE (2)

  • CWE-552 Files or Directories Accessible to External Parties weakness
  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References