Search
Find a vulnerability
Search criteria
1 vulnerability found for OpenKM Document Management Community by OpenKM
CVE-2022-2131 (GCVE-0-2022-2131)
Vulnerability from cvelistv5 – Published: 2022-07-25 14:20 – Updated: 2024-09-17 01:10
VLAI
EPSS
VEX
Title
OpenKM XXE Injection
Summary
OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack.
Severity
8.5 (High)
CWE
- CWE-611 - improper restriction of XML external entity reference (XXE)
Assigner
INCIBE
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.incibe-cert.es/en/early-warning/secur… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OpenKM | OpenKM Document Management Community |
Affected:
6.3.10 , ≤ 6.3.10
(custom)
|
Date Public
2022-07-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:24:44.188Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.incibe-cert.es/en/early-warning/security-advisories/openkm-xxe-injection"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OpenKM Document Management Community",
"vendor": "OpenKM",
"versions": [
{
"lessThanOrEqual": "6.3.10",
"status": "affected",
"version": "6.3.10",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Keval Shah"
}
],
"datePublic": "2022-07-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611: improper restriction of XML external entity reference (XXE)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-07-25T14:20:53.000Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.incibe-cert.es/en/early-warning/security-advisories/openkm-xxe-injection"
}
],
"source": {
"defect": [
"INCIBE-2022-0057"
],
"discovery": "EXTERNAL"
},
"title": "OpenKM XXE Injection",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve-coordination@incibe.es",
"DATE_PUBLIC": "2022-07-15T08:00:00.000Z",
"ID": "CVE-2022-2131",
"STATE": "PUBLIC",
"TITLE": "OpenKM XXE Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OpenKM Document Management Community",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "6.3.10",
"version_value": "6.3.10"
}
]
}
}
]
},
"vendor_name": "OpenKM"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Keval Shah"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-611: improper restriction of XML external entity reference (XXE)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.incibe-cert.es/en/early-warning/security-advisories/openkm-xxe-injection",
"refsource": "CONFIRM",
"url": "https://www.incibe-cert.es/en/early-warning/security-advisories/openkm-xxe-injection"
}
]
},
"source": {
"defect": [
"INCIBE-2022-0057"
],
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2022-2131",
"datePublished": "2022-07-25T14:20:53.830Z",
"dateReserved": "2022-06-20T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:10:51.016Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}