Strix
26.1K

CVE-2022-23308

HIGHCVSS 7.5/10EPSS 6.01%

Last modified

CVE-2022-23308 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.. EPSS estimates a 6.01% chance of exploitation in the next 30 days.

Description

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
6.01%

92.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
XmlsoftLibxml2< 2.9.13
FedoraprojectFedora34
DebianDebian Linux9.0
AppleIpados< 15.5
AppleIphone Os< 15.5
AppleMac Os X>= 10.15.0, < 10.15.7
AppleMac Os X10.15.7
AppleMacos>= 11.6.0, < 11.6.6
AppleMacos>= 12.0, < 12.4
AppleTvos< 15.5
AppleWatchos< 8.6
NetappActive Iq Unified ManagerAll versions
NetappClustered Data OntapAll versions
NetappClustered Data Ontap Antivirus ConnectorAll versions
NetappManageability Software Development KitAll versions
NetappOntap Select Deploy Administration UtilityAll versions
NetappSmi-S ProviderAll versions
NetappSnapdriveAll versions
NetappSnapmanagerAll versions
NetappSolidfire\, Enterprise Sds \& Hci Storage NodeAll versions
NetappSolidfire \& Hci Management NodeAll versions
NetappBootstrap OsAll versions
NetappH300s FirmwareAll versions
NetappH500s FirmwareAll versions
NetappH700s FirmwareAll versions
NetappH300e FirmwareAll versions
NetappH500e FirmwareAll versions
NetappH700e FirmwareAll versions
NetappH410s FirmwareAll versions
NetappH410c FirmwareAll versions
OracleCommunications Cloud Native Core Binding Support Function22.2.0
OracleCommunications Cloud Native Core Network Function Cloud Native Environment22.1.0
OracleCommunications Cloud Native Core Network Repository Function22.1.2
OracleCommunications Cloud Native Core Network Repository Function22.2.0
OracleCommunications Cloud Native Core Network Slice Selection Function22.1.1
OracleCommunications Cloud Native Core Unified Data Repository22.2.0
OracleMysql Workbench<= 8.0.29
OracleZfs Storage Appliance Kit8.8

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2022-23308?
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
How severe is CVE-2022-23308?
CVE-2022-23308 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 6.01% probability of exploitation in the next 30 days.
How do I fix CVE-2022-23308?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-23308?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST