CVE-2022-32458 Data Systems Consulting Co., Ltd. BPM - XML External Entity (XXE) Injection
An unauthenticated remote attacker can exploit an XML External Entity vulnerability to access arbitrary system files in Digiwin BPM.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-32458?
CVE-2022-32458 is a high-severity vulnerability in Data Systems Consulting Co., Ltd. BPM, published on 20 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files.
Weakness: CWE-611
Which versions are affected by CVE-2022-32458?
It affects 1 product.
Products include Digiwin Business Process Management.
How do I fix CVE-2022-32458?
No fix has been published for CVE-2022-32458 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-32458 being exploited?
There is no known exploitation of CVE-2022-32458 in the wild and no public exploit code.
Other vulnerabilities in Data Systems Consulting Co., Ltd. BPM
Sources
Also known as GHSA-g939-v35m-p2v6.