CVE-2022-22795 Signiant - Manager+Agents XML External Entity (XXE)
An attacker can exploit an XML External Entity vulnerability to read arbitrary system files, potentially stealing sensitive information from the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-22795?
CVE-2022-22795 is a medium-severity vulnerability in Signiant, published on 9 Mar 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Signiant - Manager+Agents XML External Entity (XXE) - Extract internal files of the affected machine An attacker can read all the system files, the product is running with root on Linux systems and nt/authority on windows systems, which allows him to access and extract any file on the systems, such as passwd, shadow, hosts and so on. By gaining access to these files, attackers can steal sensitive information from the victims machine.
Weakness: CWE-611
Which versions are affected by CVE-2022-22795?
It affects 1 product.
Products include Signiant Manager\+agents.
How do I fix CVE-2022-22795?
No fix has been published for CVE-2022-22795 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-22795 being exploited?
There is no known exploitation of CVE-2022-22795 in the wild and no public exploit code.
Other vulnerabilities in Signiant
Sources
Also known as GHSA-5mqh-p682-wf6c.