CVE-2022-41967 Improper Restriction of XML External Entity Reference in Dragonfly
An attacker can exploit improper XML parsing in Dragonfly to read sensitive files or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-41967?
CVE-2022-41967 is a high-severity vulnerability in HyperaDev Dragonfly, published on 27 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (XXE) attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dragonfly only parses XML `SNAPSHOT` versions are being resolved, this vulnerability may be avoided by not trying to resolve `SNAPSHOT` versions.
Weakness: CWE-611
Which versions are affected by CVE-2022-41967?
It affects 1 product.
Products include Hypera Dragonfly.
How do I fix CVE-2022-41967?
No fix has been published for CVE-2022-41967 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-41967 being exploited?
There is no known exploitation of CVE-2022-41967 in the wild and no public exploit code.
Sources
Also known as GHSA-6x3m-96qp-mmxv.