CVE-2022-41967CWE-611

Improper Restriction of XML External Entity Reference in Dragonfly

High · published December 27, 2022

CVSS v3.1
7.0
EPSS
1%
Percentile
45.9
In the wild
Unconfirmed
What it is

Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (XXE) attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dragonfly only parses XML `SNAPSHOT` versions are being resolved, this vulnerability may be avoided by not trying to resolve `SNAPSHOT` versions.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00560 · 45.9th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2022-12-27T23:45Z
EPSS history
Timeline
  • 27 DEC 23:45Z
    Improper Restriction of XML External Entity Reference in Dragonfly
    cvelistv5