CVE-2022-21949 HIGH

CVE-2022-21949: Multiple XXE vulnerabilities in OBS

Vendor Suse
Product Open Build Service
Weakness CWE-611 · XXE
Published May 3, 2022
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be abused to escalate to Admin privileges on OBS. This issue affects: SUSE Open Build Service Open Build Service versions prior to 2.10.13.

Key dates

02Disclosure timeline

May 3, 2022 CVE published
September 16, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-23195 Apache Ambari: XML External Entity (XXE) Vulnerability in Ambari/Oozie CVE-2025-11700 N-central Multiple XXE Injection Vulnerabilities CVE-2025-2365 crmeb_java WeChatMessageController.java webHook xml external entity reference CVE-2026-41936 Vvveb < 1.0.8.2 XML External Entity Injection via Import CVE-2017-3206 The Action Message Format (AMF3) deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages