Vulnerability · Published Mar 9, 2022 · Assigned by INCD

CVE-2022-22795Signiant - Manager+Agents XML External Entity (XXE)

Medium 6.8

In plain English

A medium-severity XML external entity in Signiant from Signiant. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)1.1%top 35.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Signiant - Manager+Agents XML External Entity (XXE) - Extract internal files of the affected machine An attacker can read all the system files, the product is running with root on Linux systems and nt/authority on windows systems, which allows him to access and extract any file on the systems, such as passwd, shadow, hosts and so on. By gaining access to these files, attackers can steal sensitive information from the victims machine.

Affected products (as reported)

Vendor	Product	Versions
Signiant	Signiant	Signiant Build 78045 13.5.0Signiant Build 79008,14.0.0Signiant Build 79687 14.1.0Signiant Build 79687 15.0.0

Weakness: CWE-611 · Vector: CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

References

https://www.gov.il/en/departments/faq/cve_advisories x_refsource_MISC