CVE-2022-2458: XEE
An XML external entity injection(XXE) vulnerability was found in Business Central. This flaw allows an attacker to interfere with an application's processing of XML data. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. Here, the XML external entity injection leads to External Service interaction and an Internal file read in Business Central and Kie-Server APIs.
Other sources
IBM pentesting results : https://docs.google.com/spreadsheets/d/1Iwbhk0lwGoNskLidsY5CXmc5MwKt5VfmJCaX21xyruo
XML external entity injection(XXE) is a vulnerability that allows an attacker to interfere with an application's processing of XML data. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. Here, XML external entity injection lead to External Service interaction & Internal file read in Business Central and also Kie-Server APIs.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-2458?
CVE-2022-2458 is an XML external entity injection (XXE) vulnerability that allows an attacker to interfere with an application's processing of XML data.
What is XML external entity injection (XXE)?
XML external entity injection (XXE) is a type of vulnerability that occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser.
How does the CVE-2022-2458 vulnerability occur?
The CVE-2022-2458 vulnerability occurs when a weakly configured XML parser processes XML input containing a reference to an external entity.
What is the severity of CVE-2022-2458?
CVE-2022-2458 has a severity rating of 8.2 (High).
How can I fix the CVE-2022-2458 vulnerability?
To fix the CVE-2022-2458 vulnerability, it is recommended to update to a version of Redhat Process Automation Manager that is not affected by the vulnerability.