Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

2 vulnerabilities found for OpenKM Document Management Community by OpenKM

CVE-2022-2131 (GCVE-0-2022-2131)

Vulnerability from nvd – Published: 2022-07-25 14:20 – Updated: 2024-09-17 01:10
VLAI?
Title
OpenKM XXE Injection
Summary
OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack.
Severity ?
8.5 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
CWE
  • CWE-611 - improper restriction of XML external entity reference (XXE)
Assigner
References
Impacted products
Vendor Product Version
OpenKM OpenKM Document Management Community Affected: 6.3.10 , ≤ 6.3.10 (custom)
Create a notification for this product.
Date Public ?
2022-07-15 00:00
Credits
Keval Shah
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:24:44.188Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.incibe-cert.es/en/early-warning/security-advisories/openkm-xxe-injection"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenKM Document Management Community",
          "vendor": "OpenKM",
          "versions": [
            {
              "lessThanOrEqual": "6.3.10",
              "status": "affected",
              "version": "6.3.10",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Keval Shah"
        }
      ],
      "datePublic": "2022-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611: improper restriction of XML external entity reference (XXE)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-25T14:20:53.000Z",
        "orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
        "shortName": "INCIBE"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.incibe-cert.es/en/early-warning/security-advisories/openkm-xxe-injection"
        }
      ],
      "source": {
        "defect": [
          "INCIBE-2022-0057"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "OpenKM XXE Injection",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-coordination@incibe.es",
          "DATE_PUBLIC": "2022-07-15T08:00:00.000Z",
          "ID": "CVE-2022-2131",
          "STATE": "PUBLIC",
          "TITLE": "OpenKM XXE Injection"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "OpenKM Document Management Community",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "6.3.10",
                            "version_value": "6.3.10"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "OpenKM"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Keval Shah"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-611: improper restriction of XML external entity reference (XXE)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.incibe-cert.es/en/early-warning/security-advisories/openkm-xxe-injection",
              "refsource": "CONFIRM",
              "url": "https://www.incibe-cert.es/en/early-warning/security-advisories/openkm-xxe-injection"
            }
          ]
        },
        "source": {
          "defect": [
            "INCIBE-2022-0057"
          ],
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
    "assignerShortName": "INCIBE",
    "cveId": "CVE-2022-2131",
    "datePublished": "2022-07-25T14:20:53.830Z",
    "dateReserved": "2022-06-20T00:00:00.000Z",
    "dateUpdated": "2024-09-17T01:10:51.016Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-2131 (GCVE-0-2022-2131)

Vulnerability from cvelistv5 – Published: 2022-07-25 14:20 – Updated: 2024-09-17 01:10
VLAI?
Title
OpenKM XXE Injection
Summary
OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack.
Severity ?
8.5 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
CWE
  • CWE-611 - improper restriction of XML external entity reference (XXE)
Assigner
References
Impacted products
Vendor Product Version
OpenKM OpenKM Document Management Community Affected: 6.3.10 , ≤ 6.3.10 (custom)
Create a notification for this product.
Date Public ?
2022-07-15 00:00
Credits
Keval Shah
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:24:44.188Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.incibe-cert.es/en/early-warning/security-advisories/openkm-xxe-injection"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenKM Document Management Community",
          "vendor": "OpenKM",
          "versions": [
            {
              "lessThanOrEqual": "6.3.10",
              "status": "affected",
              "version": "6.3.10",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Keval Shah"
        }
      ],
      "datePublic": "2022-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611: improper restriction of XML external entity reference (XXE)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-25T14:20:53.000Z",
        "orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
        "shortName": "INCIBE"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.incibe-cert.es/en/early-warning/security-advisories/openkm-xxe-injection"
        }
      ],
      "source": {
        "defect": [
          "INCIBE-2022-0057"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "OpenKM XXE Injection",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-coordination@incibe.es",
          "DATE_PUBLIC": "2022-07-15T08:00:00.000Z",
          "ID": "CVE-2022-2131",
          "STATE": "PUBLIC",
          "TITLE": "OpenKM XXE Injection"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "OpenKM Document Management Community",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "6.3.10",
                            "version_value": "6.3.10"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "OpenKM"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Keval Shah"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-611: improper restriction of XML external entity reference (XXE)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.incibe-cert.es/en/early-warning/security-advisories/openkm-xxe-injection",
              "refsource": "CONFIRM",
              "url": "https://www.incibe-cert.es/en/early-warning/security-advisories/openkm-xxe-injection"
            }
          ]
        },
        "source": {
          "defect": [
            "INCIBE-2022-0057"
          ],
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
    "assignerShortName": "INCIBE",
    "cveId": "CVE-2022-2131",
    "datePublished": "2022-07-25T14:20:53.830Z",
    "dateReserved": "2022-06-20T00:00:00.000Z",
    "dateUpdated": "2024-09-17T01:10:51.016Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}