5.5

CVE-2022-0219

Exploit

Improper Restriction of XML External Entity Reference in skylot/jadx

Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jadx Project ≫ Jadx Version < 1.3.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.06% 0.601
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
security@huntr.dev 5.5 1.8 3.6
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

https://github.com/skylot/jadx/commit/d22db30166e7cb369d72be41382bb63ac8b81c52
Patch
Third Party Advisory
https://huntr.dev/bounties/0d093863-29e8-4dd7-a885-64f76d50bf5e
Patch
Third Party Advisory
Exploit
Issue Tracking