What’s Vulnerable › Vulnerabilities

CVE-2022-21949: Multiple XXE vulnerabilities in OBS

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-05-03 · updated 2026-06-17
• Weakness: CWE-611

Description

A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be abused to escalate to Admin privileges on OBS. This issue affects: SUSE Open Build Service Open Build Service versions prior to 2.10.13.

Affected products

• openSUSE Open Build Service: before 2.10.13 — fixed in 2.10.13

How to fix

Upgrade to a fixed version: openSUSE Open Build Service 2.10.13. Check the vendor advisory for mitigations.

References

• https://bugzilla.suse.com/show_bug.cgi?id=1197928
• https://bugzilla.suse.com/show_bug.cgi?id=1197928

Get alerted when CVE-2022-21949 or the next vulnerability affects your stack