Published: 29/07/2022 Updated: 04/08/2022

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 0

Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote malicious user to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.

Vulnerable Product	Search on Vulmon	Subscribe to Product
dogtagpki dogtagpki 10.5.18
dogtagpki dogtagpki 10.7.4
dogtagpki dogtagpki 10.8.3
dogtagpki dogtagpki 10.11.2
dogtagpki dogtagpki 10.12.4
dogtagpki dogtagpki 11.0.5
dogtagpki dogtagpki 11.1.0

Debian Bug report logs - #1014957 dogtag-pki: CVE-2022-2414 Package: src:dogtag-pki; Maintainer for src:dogtag-pki is Debian FreeIPA Team <pkg-freeipa-devel@alioth-listsdebiannet>; Reported by: Moritz Mühlenhoff <jmm@inutilorg> Date: Fri, 15 Jul 2022 10:30:01 UTC Severity: grave Tags: security Reply or subs ...

Synopsis Important: pki-core security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for pki-core is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having ...

Synopsis Important: Red Hat Certificate System 97 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update is now available for Red Hat Certificate System 97Red Hat Product Security has rated this upda ...

Synopsis Important: pki-core:106 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the pki-core:106 module is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Pr ...

Synopsis Important: pki-core:106 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the pki-core:106 module is now available for Red Hat Enterprise Linux 82 Advanced Update Support, Red Hat E ...

Synopsis Important: pki-core security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for pki-core is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as having ...

Synopsis Important: pki-core:106 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the pki-core:106 module is now available for Red Hat Enterprise Linux 84 Extended Update SupportRed Hat Pr ...

Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests (CVE-2022-2414) ...

CVE-2022-2414-POC Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests (It does"potentially" confirmed) portswiggernet/daily-swig/vulnerability-in-open-source-identity-manage

CVE-2022-2414 POC

CVE-2022-2414 CVE-2022-2414 POC Replace YOUR_HOST with your target like below url url = "examplecom/ca/rest/certrequests"

CVE-2022-2414 POC

CVE-2022-2414 CVE-2022-2414 POC Replace YOUR_HOST with your target like below url url = "examplecom/ca/rest/certrequests"

A flaw was found in pki-core. Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.

CVE-2022-2414-Proof-Of-Concept A flaw was found in pki-core Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests References: nvdnistgov/vuln/detail/CVE-2022-2414 accessredhatco

CWE-611 https://github.com/dogtagpki/pki/pull/4021 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014957 https://nvd.nist.gov https://github.com/strikersatya/CVE-2022-2414 https://alas.aws.amazon.com/AL2/ALAS-2023-2016.html

CVE-2022-2414

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect