CVE-2022-27193

Published March 15th, 2022

View on NVD ↗

CVSS v3

6.1

MEDIUM

CVSS v2

4.3

MEDIUM

Affected

PROJECT

Description

CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter.

csaf-tools/CVRF-CSAF-Converter

A CVRF CSAF Converter, taking care about OASIS specification.

GitHub