PT-2022-18280 · Unknown · Cvrf-Csaf-Converter

CVE-2022-27193 · Published 2022-03-15 · Updated 2026-07-02

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AC:L/AV:L/A:L/C:H/I:N/PR:N/S:U/UI:R

Name of the Vulnerable Software and Affected Versions CVRF-CSAF-Converter versions prior to 1.0.0-rc2

Description The issue allows for the inclusion of arbitrary local file content into the generated output document due to XML External Entities (XXE). This can be exploited by an attacker to disclose information from the system running the converter.

Recommendations For versions prior to 1.0.0-rc2, update to version 1.0.0-rc2 or later to resolve the issue.

Exploit

Fix

Files Accessible to External Parties

XXE

Weakness Enumeration

CWE-552

CWE-611

Related Identifiers

CVE-2022-27193

GHSA-M8GQ-83GH-V42V

PYSEC-2026-627

Affected Products

Cvrf-Csaf-Converter

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/27xxx/CVE-2022-27193.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-27193 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m8gq-83gh-v42v · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-627 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27193 · Security Note
• https://github.com/csaf-tools/CVRF-CSAF-Converter · Note
• https://github.com/csaf-tools/CVRF-CSAF-Converter/releases/tag/1.0.0-rc2 · Note
• https://pypi.org/project/cvrf2csaf · Note
• https://github.com/advisories/GHSA-m8gq-83gh-v42v · Note