CVE-2022-21949

EUVD-2022-27105
A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be abused to escalate to Admin privileges on OBS. This issue affects: SUSE Open Build Service Open Build Service versions prior to 2.10.13.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
suseCNA
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 81%
Affected Products (NVD)
VendorProductVersion
opensuseopen_build_service
𝑥
< 2.10.13
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ruby-xmlhash
bookworm
1.3.6-3.1
fixed
bullseye
no-dsa
buster
no-dsa
sid
1.3.6-3.1
fixed
trixie
1.3.6-3.1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby-xmlhash
bionic
needs-triage
focal
needs-triage
impish
ignored
jammy
needs-triage
kinetic
ignored
lunar
ignored
mantic
ignored
noble
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://bugzilla.suse.com/show_bug.cgi?id=1197928
https://bugzilla.suse.com/show_bug.cgi?id=1197928