CVE-2022-2131: OpenKM XXE Injection
OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2131?
CVE-2022-2131 is rated as a medium severity vulnerability due to its potential for XML external entity injection attacks.
How do I fix CVE-2022-2131?
To fix CVE-2022-2131, ensure you are using OpenKM Community Edition version 6.3.11 or later, which implements the necessary security flags in XML processing.
What are the potential impacts of CVE-2022-2131?
Exploitation of CVE-2022-2131 can lead to unauthorized access to sensitive data, file retrieval, and potential denial of service attacks.
Is CVE-2022-2131 exploitable remotely?
Yes, CVE-2022-2131 is exploitable remotely if an attacker can send crafted XML data to the vulnerable OpenKM application.
Which versions of OpenKM are affected by CVE-2022-2131?
CVE-2022-2131 affects OpenKM Community Edition versions 6.3.10 and earlier.