CVE-2022-33977

Katalog CVE

CVSS 7.5 · High EPSS 1,8%

Kerentanan Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') pada untangle project untangle. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service (DoS) condition on the server where the product is running.

Rincian

Terbit di NVD

26 Juli 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 78,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/stchris/untangle product · advisory pihak ketiga
• https://github.com/stchris/untangle/releases/tag/1.2.1 release notes · advisory pihak ketiga
• https://jvn.jp/en/jp/JVN30454777/ advisory pihak ketiga