CVE-2022-2131

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-2131

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-2131.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-2131

Published

2022-07-25T14:20:53.830Z

Modified

2026-07-15T01:48:55.829570237Z

Severity

8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L CVSS Calculator

Summary

OpenKM XXE Injection

Details

OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack.

Database specific

{
    "cna_assigner": "INCIBE",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2131.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "6.3.10"
                },
                {
                    "last_affected": "6.3.10"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-611"
    ]
}

References

Affected packages

Git / github.com/openkm/document-management-system

Affected ranges

Type

GIT

Repo

https://github.com/openkm/document-management-system

Events

Introduced

Last affected

1aaa1f2cade7115a4553e51917b70269a426f9f5

Database specific

{
    "cpe": "cpe:2.3:a:openkm:openkm:*:*:*:*:community:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.3.10"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

Other

none

v6.*

v6.3.10

v6.3.3

v6.3.5

v6.3.6

v6.3.7

v6.3.8

v6.3.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-2131.json"