Lucene search

MitreCVE-2022-45326

HistoryDec 06, 2022 - 5:15 p.m.

CVE-2022-45326

2022-12-0617:15:11

CWE-611

mitre

web.nvd.nist.gov

cve-2022-45326

xml

xxe

injection

vulnerability

kwoksys kwok information server

ssrf

nvd

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

40.2%

JSON

An XML external entity (XXE) injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks.

Affected configurations

Nvd

Node

kwoksysinformation_serverRange<2.9.5

kwoksysinformation_serverMatch2.9.5sp23

kwoksysinformation_serverMatch2.9.5sp25

kwoksysinformation_serverMatch2.9.5sp26

kwoksysinformation_serverMatch2.9.5sp29

kwoksysinformation_serverMatch2.9.5sp30

VendorProductVersionCPE
kwoksysinformation_server*cpe:2.3:a:kwoksys:information_server:*:*:*:*:*:*:*:*
kwoksysinformation_server2.9.5cpe:2.3:a:kwoksys:information_server:2.9.5:sp23:*:*:*:*:*:*
kwoksysinformation_server2.9.5cpe:2.3:a:kwoksys:information_server:2.9.5:sp25:*:*:*:*:*:*
kwoksysinformation_server2.9.5cpe:2.3:a:kwoksys:information_server:2.9.5:sp26:*:*:*:*:*:*
kwoksysinformation_server2.9.5cpe:2.3:a:kwoksys:information_server:2.9.5:sp29:*:*:*:*:*:*
kwoksysinformation_server2.9.5cpe:2.3:a:kwoksys:information_server:2.9.5:sp30:*:*:*:*:*:*

Vendor	Product	Version	CPE
kwoksys	information_server	*	cpe:2.3:a:kwoksys:information_server::::::::
kwoksys	information_server	2.9.5	cpe:2.3:a:kwoksys:information_server:2.9.5:sp23::::::
kwoksys	information_server	2.9.5	cpe:2.3:a:kwoksys:information_server:2.9.5:sp25::::::
kwoksys	information_server	2.9.5	cpe:2.3:a:kwoksys:information_server:2.9.5:sp26::::::
kwoksys	information_server	2.9.5	cpe:2.3:a:kwoksys:information_server:2.9.5:sp29::::::
kwoksys	information_server	2.9.5	cpe:2.3:a:kwoksys:information_server:2.9.5:sp30::::::

References

www.kwoksys.com/wiki/index.php?title=Release_Notes

www.navsec.net/2022/11/12/kwoksys-xxe.html

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

40.2%

JSON

Related for CVE-2022-45326