CVE-2022-21949

8.8 highEPSS 1.9%

High (8.8) in opensuse open build service. EPSS 1.9% chance of exploitation in the next 30 days.

A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be abused to escalate to Admin privileges on OBS. This issue affects: SUSE Open Build Service Open Build Service versions prior to 2.10.13.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2022-05-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

opensuse:open_build_service

References

https://bugzilla.suse.com/show_bug.cgi?id=1197928
https://bugzilla.suse.com/show_bug.cgi?id=1197928

Check your stack JSON