CVE-2022-45326

Опубликовано: 06 дек. 2022

Источник: nvd

CVSS3: 4.9

EPSS Низкий

Описание

An XML external entity (XXE) injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks.

Ссылки

http://www.kwoksys.com/wiki/index.php?title=Release_Notes
Release Notes
Vendor Advisory
https://www.navsec.net/2022/11/12/kwoksys-xxe.html
Exploit
Patch
Third Party Advisory
http://www.kwoksys.com/wiki/index.php?title=Release_Notes
Release Notes
Vendor Advisory
https://www.navsec.net/2022/11/12/kwoksys-xxe.html
Exploit
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:kwoksys:information_server:*:*:*:*:*:*:*:*

Версия до 2.9.5 (исключая)

cpe:2.3:a:kwoksys:information_server:2.9.5:sp23:*:*:*:*:*:*

cpe:2.3:a:kwoksys:information_server:2.9.5:sp25:*:*:*:*:*:*

cpe:2.3:a:kwoksys:information_server:2.9.5:sp26:*:*:*:*:*:*

cpe:2.3:a:kwoksys:information_server:2.9.5:sp29:*:*:*:*:*:*

cpe:2.3:a:kwoksys:information_server:2.9.5:sp30:*:*:*:*:*:*

EPSS

Процентиль: 68%

0.0056

Низкий

4.9 Medium

CVSS3

Дефекты

CWE-611

Связанные уязвимости

GHSA-ggpq-cprg-v67r