CVE-2022-0217

HIGH
Published Aug 26, 20223y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Aug 26, 2022 3y ago
Last Modified Jun 17, 2026 2w ago

Description

It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-611
CWE-776

Affected Products 1

VendorProductVersionRange
prosodyprosody* <0.11.12

References 3

  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2040639
    Issue TrackingThird Party Advisory
  • prosody.im https://prosody.im/security/advisory_20220113/
    ExploitPatchVendor Advisory
  • prosody.im https://prosody.im/security/advisory_20220113/1.patch
    PatchVendor Advisory

Remediation

  • prosody.im https://prosody.im/security/advisory_20220113/
    ExploitPatchVendor Advisory
  • prosody.im https://prosody.im/security/advisory_20220113/1.patch
    PatchVendor Advisory