CVE-2022-41967 HIGH

CVE-2022-41967: Improper Restriction of XML External Entity Reference in Dragonfly

Vendor Hyperadev
Product Dragonfly
Weakness CWE-611 · XXE
Published December 27, 2022
Last update April 14, 2025
View on NVD All CVEs

CVSS base score

7.0/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

What the vulnerability does

01Description

Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (XXE) attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dragonfly only parses XML `SNAPSHOT` versions are being resolved, this vulnerability may be avoided by not trying to resolve `SNAPSHOT` versions.

Key dates

02Disclosure timeline

December 27, 2022 CVE published
April 14, 2025 Record updated