Vulnerability · Published Dec 27, 2022 · Assigned by GitHub_M

CVE-2022-41967Improper Restriction of XML External Entity Reference in Dragonfly

High 7.0

In plain English

A high-severity XML external entity in Dragonfly from HyperaDev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High

Exploit odds (30 days)0.6%top 52.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (XXE) attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dragonfly only parses XML `SNAPSHOT` versions are being resolved, this vulnerability may be avoided by not trying to resolve `SNAPSHOT` versions.

Affected products (as reported)

Vendor	Product	Versions
HyperaDev	Dragonfly	>= 0.3.0-SNAPSHOT, < 0.3.1-SNAPSHOT

Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

References

https://github.com/HyperaDev/Dragonfly/security/advisories/GHSA-6x3m-96qp-mmxv x_refsource_CONFIRM
https://github.com/HyperaDev/Dragonfly/commit/9661375e1135127ca6cdb5712e978bec33cc06b3 x_refsource_MISC