CVE-2022-0217

Katalog CVE

CVSS 7.5 · High EPSS 5,4%

Kerentanan Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') pada prosody. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).

Rincian

Terbit di NVD

26 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CWE-611: Improper Restriction of XML External Entity Reference

EPSS (30 hari)

5,4% peluang dieksploitasi; lebih tinggi dari 92,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://prosody.im/security/advisory_20220113/ exploit · patch · advisory vendor
• https://prosody.im/security/advisory_20220113/1.patch patch · advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2040639 issue tracking · advisory pihak ketiga