GHSA-vqmf-2v99-hhqq

GHSA-vqmf-2v99-hhqq PUBLISHED CVSS 6.900000095367432 MEDIUM

Record from GitHub Advisory Database · Published May 24, 2022

A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial of service, server side request forgery due to improper configuration of the XML parser.

Risk scores

CVSS 4.0

6.900000095367432

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Timeline

May 24, 2022 CVE Published
Apr 9, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-vqmf-2v99-hhqq
vulnetix vdb fixes GHSA-vqmf-2v99-hhqq

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-vqmf-2v99-hhqq/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →