CVE-2022-21949

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be abused to escalate to Admin privileges on OBS. This issue affects: SUSE Open Build Service Open Build Service versions prior to 2.10.13.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published: May 3, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-219505.3A Improper Access Control vulnerability in the systemd service of cana in openSUSE Backports SLE-15-SP3, openSUSE Backports SLE-15-SP4 allow CVE-2022-219516.8A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change CVE-2022-219527.5A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows re CVE-2022-219538.8A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in CVE-2022-219546.1Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability CVE-2022-219577.2Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability CVE-2022-219586.8Windows Resilient File System (ReFS) Remote Code Execution Vulnerability CVE-2022-219596.8Windows Resilient File System (ReFS) Remote Code Execution Vulnerability CVE-2022-21968.8A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks CVE-2022-219606.8Windows Resilient File System (ReFS) Remote Code Execution Vulnerability CVE-2022-219616.8Windows Resilient File System (ReFS) Remote Code Execution Vulnerability CVE-2022-219626.8Windows Resilient File System (ReFS) Remote Code Execution Vulnerability