PT-2022-18280 · Unknown · Cvrf-Csaf-Converter

Published 2022-03-15 · Updated 2023-08-08 · CVE-2022-27193

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AC:L/AV:L/A:L/C:H/I:N/PR:N/S:U/UI:R

Name of the Vulnerable Software and Affected Versions CVRF-CSAF-Converter versions prior to 1.0.0-rc2

Description The issue allows for the inclusion of arbitrary local file content into the generated output document due to XML External Entities (XXE). This can be exploited by an attacker to disclose information from the system running the converter.

Recommendations For versions prior to 1.0.0-rc2, update to version 1.0.0-rc2 or later to resolve the issue.

Fix

XXE

Files Accessible to External Parties

Weakness Enumeration

CWE-611

CWE-552

Related Identifiers

CVE-2022-27193

GHSA-M8GQ-83GH-V42V

Affected Products

Cvrf-Csaf-Converter

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-27193 · Security Note
• https://osv.dev/vulnerability/GHSA-m8gq-83gh-v42v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27193 · Vendor Advisory
• https://github.com/csaf-tools/CVRF-CSAF-Converter/releases/tag/1.0.0-rc2 · Note
• https://github.com/csaf-tools/CVRF-CSAF-Converter · Note