CVE-2022-2414
pki-core: access to external entities when parsing XML can lead to XXE
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · June 10, 2022
Updated · November 22, 2025
Description
A flaw was found in pki-core. Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
There is no known mitigation for this issue, please update the affected package as soon as possible.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-611 · Improper Restriction of XML External Entity Reference