CVE-2022-45588

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-45588
All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) type of attacks. Users should download the R2022-09 release or later and use it in place of the previous version. Talend Remote Engine Gen 1 and Talend Cloud Engine for Design are not impacted. This XXE vulnerability could only be exploited by someone with the appropriate rights to edit pipelines on the Talend platform. It could not be triggered remotely or by other user input.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://talend.com Vendor Advisory
https://www.talend.com/security/incident-response/#CVE-2022-45588 Vendor Advisory
http://talend.com Vendor Advisory
https://www.talend.com/security/incident-response/#CVE-2022-45588 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:talend:remote_engine_gen_2:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:29

Type Values Removed Values Added
References () http://talend.com - Vendor Advisory () http://talend.com - Vendor Advisory
References () https://www.talend.com/security/incident-response/#CVE-2022-45588 - Vendor Advisory () https://www.talend.com/security/incident-response/#CVE-2022-45588 - Vendor Advisory

16 Mar 2023, 03:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
Summary XML External Entity (XXE) vulnerability in Talend Remote Engine Gen 2 before R2022-09. All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) type of attacks. Users should download the R2022-09 release or later and use it in place of the previous version. Talend Remote Engine Gen 1 and Talend Cloud Engine for Design are not impacted. This XXE vulnerability could only be exploited by someone with the appropriate rights to edit pipelines on the Talend platform. It could not be triggered remotely or by other user input.
CPE cpe:2.3:a:talend:remote_engine_gen_2:*:*:*:*:*:*:*:*
CWE CWE-611
References (MISC) https://www.talend.com/security/incident-response/#CVE-2022-45588 - (MISC) https://www.talend.com/security/incident-response/#CVE-2022-45588 - Vendor Advisory
References (MISC) http://talend.com - (MISC) http://talend.com - Vendor Advisory

03 Feb 2023, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-02-03 21:15

Updated : 2024-11-21 07:29

NVD link : CVE-2022-45588

Mitre link : CVE-2022-45588

CVE.ORG link : CVE-2022-45588

JSON object : View

Products Affected

talend

  • remote_engine_gen_2
CWE
CWE-611

Improper Restriction of XML External Entity Reference