CVE-2022-2458: XEE
First published: Mon Jul 18 2022(Updated: )
An XML external entity injection(XXE) vulnerability was found in Business Central. This flaw allows an attacker to interfere with an application's processing of XML data. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. Here, the XML external entity injection leads to External Service interaction and an Internal file read in Business Central and Kie-Server APIs.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Process Automation Manager | <7.13.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=2107994#c0
- https://docs.google.com/spreadsheets/d/1Iwbhk0lwGoNskLidsY5CXmc5MwKt5VfmJCaX21xyruo
- https://access.redhat.com/errata/RHSA-2022:6813
- https://access.redhat.com/security/cve/cve-2022-2458
- https://bugzilla.redhat.com/show_bug.cgi?id=2107994
- https://www.cve.org/CVERecord?id=CVE-2022-2458 https://nvd.nist.gov/vuln/detail/CVE-2022-2458
Frequently Asked Questions
What is CVE-2022-2458?
CVE-2022-2458 is an XML external entity injection (XXE) vulnerability that allows an attacker to interfere with an application's processing of XML data.
What is XML external entity injection (XXE)?
XML external entity injection (XXE) is a type of vulnerability that occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser.
How does the CVE-2022-2458 vulnerability occur?
The CVE-2022-2458 vulnerability occurs when a weakly configured XML parser processes XML input containing a reference to an external entity.
What is the severity of CVE-2022-2458?
CVE-2022-2458 has a severity rating of 8.2 (High).
How can I fix the CVE-2022-2458 vulnerability?
To fix the CVE-2022-2458 vulnerability, it is recommended to update to a version of Redhat Process Automation Manager that is not affected by the vulnerability.
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-2458
- agent/references
- agent/event
- agent/weakness
- agent/author
- agent/severity
- agent/tags
- agent/description
- collector/mitre-cve
- source/MITRE
- vendor/redhat
- canonical/redhat process automation manager