CVE-2022-2414
82Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 86%
from disclosure to weapon130 days
Published on NVDJul 29
1st PoC+130d
VulnCheck+474d
exploitation probability
86%top 1% of all CVEs
observed exploitation
yesVulnCheck
3 public exploit(s)
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Affected
2 products (14 components)
Red Hat Enterprise Linux 6 · Red Hat Certificate System 10
workaround: There is no known mitigation for this issue, please update the affected package as soon as possible.
Fixed
14 products (355 components)
Red Hat Enterprise Linux AppStream EUS (v.8.4) · Red Hat Enterprise Linux AppStream EUS (v.8.6) · Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream E4S (v. 8.2) · Red Hat Enterprise Linux AppStream AUS (v. 8.2) · and others 9
Not affected
2 products (99 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Certificate System 9.7 for Red Hat Enterprise Server 7
Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.
Affected products
n/a · Dogtag PKIpublic PoCs found — 3
vulncheckvulncheck.com/xdb/b37de686e133unverifiedvulncheckvulncheck.com/xdb/b8216ceefc84unverifiedvulncheckvulncheck.com/xdb/1a211964c217unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.