CVE-2022-35741

 

Published at: - 18-07-2022 05:15

Last modified: - 25-07-2022 07:59

Total changes: - 3

Description

Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML external entity (XXE) injection. This plugin is not enabled by default and the attacker would require that this plugin be enabled to exploit the vulnerability. When the SAML 2.0 plugin is enabled in affected versions of Apache CloudStack could potentially allow the exploitation of XXE vulnerabilities. The SAML 2.0 messages constructed during the authentication flow in Apache CloudStack are XML-based and the XML data is parsed by various standard libraries that are now understood to be vulnerable to XXE injection attacks such as arbitrary file reading, possible denial of service, server-side request forgery (SSRF) on the CloudStack management server.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://lists.apache.org/thread/hwhxvtwp1d5dsm156bsf1cnyvtmrfv3f
• [oss-security] 20220718 [ADVISORY] Apache CloudStack SAML Single Sign-On XXE (CVE-2022-35741)-Mailing List, Mitigation, Third Party Advisory
• [oss-security] 20220720 Re: [ADVISORY] Apache CloudStack SAML Single Sign-On XXE (CVE-2022-35741)-Mailing List, Mitigation, Third Party Advisory

 

Keywords

NVD

 

CVE-2022-35741

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures