CVE-2022-32458 - CVE House

Status published High CVE-2022-32458

Data Systems Consulting Co., Ltd. BPM - XML External Entity (XXE) Injection

7.5 CVSS

Vulnerability Description

Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-32458

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Data Systems Consulting Co., Ltd.

View All →

CVE-2022-32457

Data Systems Consulting Co., Ltd. BPM - Blind Server-Side Request Forgery (SSRF)

Medium 5.3

CVE-2022-32456

Data Systems Consulting Co., Ltd. BPM - SQL Injection

Critical 9.8

Affected Vendor

Data Systems Consulting Co., Ltd.

View all reports →

Affected Software

BPM

Vulnerable Versions:

unspecified

Timeline

Official Publish: July 20th, 2022

Last Modified: September 16th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-611

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

Initial Access

T1005 Data from Local System

Collection

T1040 Network Sniffing