CVE-2022-35741 json
Apache CloudStack SAML Single Sign-On XXE
published 2022-07-18 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-38614
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 8.0%
- EPSS 8.0% chance of exploitation in 30 days, percentile 94%
- public exploits
- 0
- none known
Summary
Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML external entity (XXE) injection. This plugin is not enabled by default and the attacker would require that this plugin be enabled to exploit the vulnerability. When the SAML 2.0 plugin is enabled in affected versions of Apache CloudStack could potentially allow the exploitation of XXE vulnerabilities. The SAML 2.0 messages constructed during the authentication flow in Apache CloudStack are XML-based and the XML data is parsed by various standard libraries that are now understood to be vulnerable to XXE injection attacks such as arbitrary file reading, possible denial of service, server-side request forgery (SSRF) on the CloudStack management server.
Patch / fix
Exploit prediction
8.01% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Apache Software Foundation Apache CloudStack
Classification
- Weakness
-
- CWE-611 Improper Restriction of XML External Entity Reference
References
-
lists.apache.org
/thread/hwhxvtwp1d5dsm156bsf1cnyvtmrfv3f
issue-tracking, mailing-list, mitigation, patch, vendor-advisory
-
openwall.com
/lists/oss-security/2022/07/18/2
mailing-list, mitigation, third-party-advisory
-
openwall.com
/lists/oss-security/2022/07/20/1
mailing-list, mitigation, third-party-advisory
Sources
- CVE List CVE-2022-35741
- NVD CVE-2022-35741
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.