High severity · published Aug 26, 2022
CVE-2022-0217
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data
7.5
CVSS
5.5%
EPSS
No
On KEV
Description
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.5% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Prosody · Prosody
before 0.11.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-0217
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-0217
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2040639
Exploit
https://prosody.im/security/advisory_20220113/
Patch
https://prosody.im/security/advisory_20220113/1.patch
More from Prosody
8.8
CVE-2018-10847
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass
7.5
CVE-2026-43507
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5
7.5
CVE-2026-43506
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5
7.5
CVE-2021-37601
muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat…
7.5
CVE-2021-32920
Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests