CVE-2022-22835
medium · 6.5An issue was discovered in OverIT Geocall before version 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XXE vulnerability to read arbitrary files from the filesystem.
6.5
CVSS
14.5%
EPSS (exploit prob.)
96th
EPSS percentile
2022-03-10
Published
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| overit | geocall | < 8.0 |
Check a specific version with /api/v1/cve/match.
References
- https://labs.yarix.com/2022/03/overit-framework-xslt-injection-and-xxe-cve-2022-22834-cve-2022-22835/
- https://labs.yarix.com/advisories/cve-2022-22835/
- https://overit.us/products/geocall/
- https://www.overit.ai/product/nextgen-fsm/
- https://labs.yarix.com/2022/03/overit-framework-xslt-injection-and-xxe-cve-2022-22834-cve-2022-22835/
- https://labs.yarix.com/advisories/cve-2022-22835/
- https://overit.us/products/geocall/
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2022-22835