An issue was discovered in OverIT Geocall before version 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XXE vulnerability to read arbitrary files from the filesystem.
References
| Link | Resource |
|---|---|
| https://labs.yarix.com/2022/03/overit-framework-xslt-injection-and-xxe-cve-2022-22834-cve-2022-22835/ | Exploit Third Party Advisory |
| https://labs.yarix.com/advisories/cve-2022-22835/ | Third Party Advisory |
| https://overit.us/products/geocall/ | Product Vendor Advisory |
| https://www.overit.ai/product/nextgen-fsm/ |
Configurations
History
18 Sep 2024, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
03 Sep 2022, 03:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://labs.yarix.com/2022/03/overit-framework-xslt-injection-and-xxe-cve-2022-22834-cve-2022-22835/ - Exploit, Third Party Advisory |
10 May 2022, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 Mar 2022, 20:12
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:overit:geocall:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 6.5 |
| CWE | CWE-611 | |
| References | (MISC) https://labs.yarix.com/advisories/cve-2022-22835/ - Third Party Advisory | |
| References | (MISC) https://overit.us/products/geocall/ - Product, Vendor Advisory |
10 Mar 2022, 17:54
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-03-10 17:45
Updated : 2024-09-18 19:15
NVD link : CVE-2022-22835
Mitre link : CVE-2022-22835
CVE.ORG link : CVE-2022-22835
JSON object : View
Products Affected
overit
- geocall
CWE
CWE-611
Improper Restriction of XML External Entity Reference