CVE-2022-41967

· HIGHModified

← All CVEs

CVSS v3.1

7.0

EPSS

0.56%

Published

Dec 27, 2022

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (XXE) attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dragonfly only parses XML `SNAPSHOT` versions are being resolved, this vulnerability may be avoided by not trying to resolve `SNAPSHOT` versions.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

Weaknesses (CWE)

CWE-611

Affected Products (1)

hypera · dragonflyvulnerable

References (4)

https://github.com/HyperaDev/Dragonfly/commit/9661375e1135127ca6cdb5712e978bec33cc06b3

PatchThird Party Advisory

https://github.com/HyperaDev/Dragonfly/security/advisories/GHSA-6x3m-96qp-mmxv

PatchThird Party Advisory

https://github.com/HyperaDev/Dragonfly/commit/9661375e1135127ca6cdb5712e978bec33cc06b3

PatchThird Party Advisory

https://github.com/HyperaDev/Dragonfly/security/advisories/GHSA-6x3m-96qp-mmxv

PatchThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs