CVE-2022-21949CWE-611

Multiple XXE vulnerabilities in OBS

High · published May 3, 2022

CVSS v3.1
8.8
EPSS
2%
Percentile
79.1
In the wild
Unconfirmed
What it is

A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be abused to escalate to Admin privileges on OBS. This issue affects: SUSE Open Build Service Open Build Service versions prior to 2.10.13.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01858 · 79.1th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2022-05-03T07:50Z
EPSS history
Timeline
  • 03 MAY 07:50Z
    Multiple XXE vulnerabilities in OBS
    cvelistv5