CVSS 3.1
5.5 mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NCVE-2022-27193
Medium (5.5) in cvrf-csaf-converter project cvrf-csaf-converter. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in cvrf2csaf 1.0.0rc2.
CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
- CWE
- CWE-611
- Published
- Modified
- Record from
- the NVD, synced
Affected
- cvrf-csaf-converter_project:cvrf-csaf-converter
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m8gq-83gh-v42v | PyPI | cvrf2csaf | <1.0.0rc2 | 1.0.0rc2 |
| PYSEC-2026-627 | PyPI | cvrf2csaf | <1.0.0rc2 | 1.0.0rc2 |