CVE-2022-21949: Multiple XXE vulnerabilities in OBS
A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be abused to escalate to Admin privileges on OBS. This issue affects: SUSE Open Build Service Open Build Service versions prior to 2.10.13.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-21949?
CVE-2022-21949 is an Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service that allows remote attackers to reference external entities in certain operations.
How does CVE-2022-21949 affect SUSE Open Build Service?
CVE-2022-21949 affects SUSE Open Build Service by allowing remote attackers to reference external entities, potentially leading to information leakage and escalation of privileges.
What is the severity of CVE-2022-21949?
The severity of CVE-2022-21949 is critical, with a CVSS score of 8.8.
Which versions of SUSE Open Build Service are affected by CVE-2022-21949?
Versions up to and excluding 2.10.13 of SUSE Open Build Service are affected by CVE-2022-21949.
Is there a fix available for CVE-2022-21949?
Yes, updating to a version of SUSE Open Build Service that is later than 2.10.13 will fix the vulnerability.