VULNERABILITY INTELLIGENCE

CVE-2022-41967

CVSS score7 HIGH
EPSS probability0.57%
CISA KEVNot currently listed
Published2022-12-28
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

Description

Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (XXE) attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dragonfly only parses XML `SNAPSHOT` versions are being resolved, this vulnerability may be avoided by not trying to resolve `SNAPSHOT` versions.

Weakness classification

  • security-advisories@github.com: CWE-611

Primary references