CVE-2022-21949 json
Multiple XXE vulnerabilities in OBS
published 2022-05-03 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-27105
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.9%
- EPSS 1.9% chance of exploitation in 30 days, percentile 79%
- public exploits
- 0
- none known
Summary
A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be abused to escalate to Admin privileges on OBS. This issue affects: SUSE Open Build Service Open Build Service versions prior to 2.10.13.
Patch / fix
- SUSE Open Build Service 2.10.13
- ruby-xmlhash Debian 12 1.3.6-3.1
debian advisories DEBIAN-CVE-2022-21949
Exploit prediction
1.86% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Affected products
- SUSE Open Build Service
Classification
- Weakness
-
- CWE-611 Improper Restriction of XML External Entity Reference
References
-
bugzilla.suse.com
/show_bug.cgi?id=1197928
issue-tracking, vendor-advisory
Sources
- CVE List CVE-2022-21949
- NVD CVE-2022-21949
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.