CVE-2022-21949 Multiple XXE vulnerabilities in OBS

High 8.8 Published 3 May 2022 Updated 16 Sep 2024

Remote attackers can exploit XML External Entity flaws in SUSE Open Build Service to read server data and escalate privileges to Admin.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-21949?

CVE-2022-21949 is a high-severity vulnerability in SUSE Open Build Service, published on 3 May 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be abused to escalate to Admin privileges on OBS. This issue affects: SUSE Open Build Service Open Build Service versions prior to 2.10.13.

Weakness: CWE-611

Which versions are affected by CVE-2022-21949?

It affects 1 product.

Products include Opensuse Open Build Service.

How do I fix CVE-2022-21949?

Upgrade to a fixed version.

Is CVE-2022-21949 being exploited?

There is no known exploitation of CVE-2022-21949 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2022-21949, GHSA-3wrh-hc8c-4jpw, OESA-2022-1674, UBUNTU-CVE-2022-21949.