CVE-2022-41967 — HIGH (7.0)

Vulnerability Description

Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (XXE) attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dragonfly only parses XML `SNAPSHOT` versions are being resolved, this vulnerability may be avoided by not trying to resolve `SNAPSHOT` versions.

CVSS Score

7.0

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

HIGH

Availability

LOW

Affected Products

Vendor	Product	Versions
Hypera	Dragonfly	0.3.0-snapshot

Related Weaknesses (CWE)

CWE-611

References

https://github.com/HyperaDev/Dragonfly/commit/9661375e1135127ca6cdb5712e978bec33PatchThird Party Advisory
https://github.com/HyperaDev/Dragonfly/security/advisories/GHSA-6x3m-96qp-mmxvPatchThird Party Advisory
https://github.com/HyperaDev/Dragonfly/commit/9661375e1135127ca6cdb5712e978bec33PatchThird Party Advisory
https://github.com/HyperaDev/Dragonfly/security/advisories/GHSA-6x3m-96qp-mmxvPatchThird Party Advisory

FAQ

What is CVE-2022-41967?

CVE-2022-41967 is a vulnerability with a CVSS score of 7.0 (HIGH). Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (XXE) attacks. This issue is patched in 0....

How severe is CVE-2022-41967?

CVE-2022-41967 has been rated HIGH with a CVSS base score of 7.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-41967?

Check the references section above for vendor advisories and patch information. Affected products include: Hypera Dragonfly.