CVE-2022-21949

A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be abused to escalate to Admin privileges on OBS. This issue affects: SUSE Open Build Service Open Build Service versions prior to 2.10.13.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
suseCNA
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 80%
VendorProductVersion
opensuseopen_build_service
𝑥
< 2.10.13
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ruby-xmlhash
bullseye
no-dsa
buster
no-dsa
sid
1.3.6-3.1
fixed
trixie
1.3.6-3.1
fixed
bookworm
1.3.6-3.1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby-xmlhash
noble
needs-triage
mantic
ignored
lunar
ignored
kinetic
ignored
jammy
needs-triage
impish
ignored
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://bugzilla.suse.com/show_bug.cgi?id=1197928
https://bugzilla.suse.com/show_bug.cgi?id=1197928