CVE-2022-41221: opentext archive_center_administration

Vulnerability summary

CVE-2022-41221 is a high (CVSS 7.1) vulnerability in opentext archive_center_administration. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 24-05-2023
   PublishedVulnerability first disclosed.
2. 17-01-2025
   Last modifiedVulnerability information updated.

Description

The client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center Administration client (Versions 16.2.3, 21.2, and older versions) could upload XML files to the application that it did not sufficiently validate. As a result, attackers could craft XML files that, when processed by the application, would cause a negative security impact such as data exfiltration or localized denial of service against the application instance and system of the user running it.

• CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.