VULNERABILITY INTELLIGENCE

CVE-2022-27193

CVSS score6.1 MEDIUM
EPSS probability0.69%
CISA KEVNot currently listed
Published2022-03-15
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

Description

CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter.

Weakness classification

  • nvd@nist.gov: CWE-611

Primary references