CVE-2022-47514

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-47514
An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, as demonstrated by a pingback.aspx POST request.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/jumpycastle/xmlrpc.net-poc Exploit Third Party Advisory
https://papercutsoftware.github.io/XML-RPC.NET/download.html Vendor Advisory
https://github.com/jumpycastle/xmlrpc.net-poc Exploit Third Party Advisory
https://papercutsoftware.github.io/XML-RPC.NET/download.html Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:xml-rpc.net_project:xml-rpc.net:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:32

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de inyección de entidad externa XML (XXE) en XML-RPC.NET anterior a 2.5.0 permite a usuarios remotos autenticados realizar ataques de server-side request forgery (SSRF), como lo demuestra una solicitud POST de pingback.aspx.
References () https://github.com/jumpycastle/xmlrpc.net-poc - Exploit, Third Party Advisory () https://github.com/jumpycastle/xmlrpc.net-poc - Exploit, Third Party Advisory
References () https://papercutsoftware.github.io/XML-RPC.NET/download.html - Vendor Advisory () https://papercutsoftware.github.io/XML-RPC.NET/download.html - Vendor Advisory
Information

Published : 2022-12-18 04:15

Updated : 2024-11-21 07:32

NVD link : CVE-2022-47514

Mitre link : CVE-2022-47514

CVE.ORG link : CVE-2022-47514

JSON object : View

Products Affected

xml-rpc.net_project

  • xml-rpc.net
CWE
CWE-611

Improper Restriction of XML External Entity Reference