What is CVE-2022-21949?

CVE-2022-21949 is a high-severity vulnerability in Opensuse Open_build_service, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 8.8/10. Published 2022-05-03.

How severe is CVE-2022-21949?

High severity. CVSS v3 base score is 8.8 out of 10.

XXE in Opensuse Open_build_service

CVE-2022-21949

A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be…

Vulnerability class: XXE (XML External Entity)

EPSS: 0.017 (74.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Opensuse Open_build_service
Suse Open Build Service — versions Open Build Service

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

meissner@suse.de (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2022-21949?: CVE-2022-21949 is a high-severity vulnerability in Opensuse Open_build_service, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 8.8/10. Published 2022-05-03.
How severe is CVE-2022-21949?: High severity. CVSS v3 base score is 8.8 out of 10.