PT-2022-26190 · Dragonfly · Dragonfly

Joshuasing · Published 2022-12-27 · Updated 2023-01-06 · CVE-2022-41967

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Dragonfly version 0.3.0-SNAPSHOT

Description The issue concerns a Java runtime dependency management library that does not configure DocumentBuilderFactory to prevent XML external entity (XXE) attacks. This can be avoided by not trying to resolve SNAPSHOT versions, as the library only parses XML for such versions.

Recommendations For Dragonfly version 0.3.0-SNAPSHOT, update to version 0.3.1-SNAPSHOT to resolve the issue. As a temporary workaround, consider avoiding the resolution of SNAPSHOT versions to minimize the risk of exploitation.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-41967

GHSA-6X3M-96QP-MMXV

Affected Products

Dragonfly

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41967.json · Exploit
• https://github.com/HyperaDev/Dragonfly/commit/9661375e1135127ca6cdb5712e978bec33cc06b3 · Patch
• https://github.com/HyperaDev/Dragonfly/security/advisories/GHSA-6x3m-96qp-mmxv · Patch
• https://osv.dev/vulnerability/CVE-2022-41967 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41967 · Security Note
• https://t.me/cvenotify/40873 · Telegram Post
• https://t.me/cvenotify/41416 · Telegram Post
• https://t.me/cvenotify/40853 · Telegram Post