CVE-2022-27193

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-15 · updated 2026-06-17
Weakness: CWE-611

Description

CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter.

Affected products

Cvrf-Csaf-Converter Project Cvrf-Csaf-Converter: 1.0.0-alpha, 1.0.0-dev1, 1.0.0-dev2, 1.0.0-dev3, 1.0.0-rc1

References

https://github.com/csaf-tools/CVRF-CSAF-Converter/releases/tag/1.0.0-rc2
https://github.com/csaf-tools/CVRF-CSAF-Converter/releases/tag/1.0.0-rc2

Get alerted when CVE-2022-27193 or the next vulnerability affects your stack