CVE-2022-32458: Data Systems Consulting Co., Ltd. BPM - XML External Entity (XXE) Injection
Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-32458?
CVE-2022-32458 is considered a high severity vulnerability as it allows unauthenticated attackers to access sensitive system files.
How do I fix CVE-2022-32458?
To mitigate CVE-2022-32458, ensure proper validation of XML input and upgrade to a version of Digiwin BPM that is not vulnerable.
What type of attack does CVE-2022-32458 facilitate?
CVE-2022-32458 facilitates an XML External Entity Injection (XXE) attack, allowing attackers to manipulate XML data.
Who is impacted by CVE-2022-32458?
Users of Digiwin Business Process Management prior to version 5.8.8.1 are impacted by CVE-2022-32458.
Can CVE-2022-32458 be exploited remotely?
Yes, CVE-2022-32458 can be exploited remotely by an unauthenticated attacker.