What is CVE-2022-39353?

CVE-2022-39353 is a critical-severity vulnerability in Xmldom, classified under Improper Input Validation. CVSS score: 9.4/10. Published 2022-11-02.

How severe is CVE-2022-39353?

Critical severity. CVSS v3 base score is 9.4 out of 10.

Is CVE-2022-39353 known to be exploited?

7 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Improper input validation in Xmldom

CVE-2022-39353

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childN…

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.010 (77.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.4 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H.

Affected products

Xmldom — versions <= 0.6.0, < 0.7.7, >= 0.8.0, < 0.8.4

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2022-39353?: CVE-2022-39353 is a critical-severity vulnerability in Xmldom, classified under Improper Input Validation. CVSS score: 9.4/10. Published 2022-11-02.
How severe is CVE-2022-39353?: Critical severity. CVSS v3 base score is 9.4 out of 10.
Is CVE-2022-39353 known to be exploited?: 7 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.