Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

XML Parsing Can Allow Attackers to Access Sensitive Files

CVE-2022-2414 · published 4 years ago
Summary

A security issue in XML parsing can allow attackers to access sensitive files. This could happen if your business uses a web application that processes XML data from untrusted sources. To protect against this, ensure your developers validate and sanitize all incoming XML data.

What to do
  • Update canonical dogtag-pki to version 11.0.0-1ubuntu0.1~esm1.
Affected software
Ecosystem VendorProductAffected versions
Ubuntu:Pro:16.04:LTS canonical dogtag-pki All versions
Ubuntu:Pro:18.04:LTS canonical dogtag-pki All versions
Ubuntu:Pro:20.04:LTS canonical dogtag-pki All versions
Ubuntu:Pro:22.04:LTS canonical dogtag-pki < 11.0.0-1ubuntu0.1~esm1
Fix: upgrade to 11.0.0-1ubuntu0.1~esm1
– dogtagpki dogtagpki 10.5.18
10.7.4
10.8.3
10.11.2
10.12.4
11.0.5
11.1.0
cpe:2.3:a:dogtagpki:dogtagpki:10.5.18:*:*:*:*:*:*:*
Original advisory text
Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by se...
Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
85% chance of attack within 30 days
Type
CWE-611XML External Entity (XXE)
Timeline
Published29 Jul 2022
Updated20 Oct 2026
First seen13 Apr 2026
Sources
UBUNTU-CVE-2022-2414 · OSV
CVE-2022-2414 · NVD
CVE-2022-2414 · OSV
Track software like this
Free during beta