Skip to main content

Lava CVE-2022-44641

MEDIUM
Improper Restriction of Recursive Entity References in DTDs (CWE-776)
2022-11-18 cve@mitre.org
Denial Of Service Lava Debian Linux
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
CVE Published
Nov 18, 2022 - 21:15 nvd
MEDIUM 6.5

DescriptionNVD

In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service.

AnalysisAI

In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-776. In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service. Affected products include: Linaro Lava, Debian Debian Linux. Version information: before 2022.11.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Lava

View all
CVE-2022-45132 CRITICAL POC
9.8 Nov 18

In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-
CVE-2022-42902 HIGH
8.8 Oct 13

In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavata
CVE-2018-12565 HIGH
8.8 Jun 19

An issue was discovered in Linaro LAVA before 2018.5.post1. Rated high severity (CVSS 8.8), this vulnerability is remote
CVE-2018-12564 MEDIUM
6.5 Jun 19

An issue was discovered in Linaro LAVA before 2018.5.post1. Rated medium severity (CVSS 6.5), this vulnerability is remo
CVE-2018-12563 MEDIUM
6.5 Jun 19

An issue was discovered in Linaro LAVA before 2018.5.post1. Rated medium severity (CVSS 6.5), this vulnerability is remo

Same weakness CWE-776 – Improper Restriction of Recursive Entity References in DTDs

View all
CVE-2025-3225 HIGH POC
7.5
CVE-2026-26278 HIGH POC
7.5
CVE-2026-29074 HIGH POC
7.5
CVE-2023-49967 HIGH POC
7.5
CVE-2022-25857 HIGH POC
7.5
CVE-2022-0217 HIGH POC
7.5
CVE-2020-5227 HIGH POC
7.5
CVE-2019-12401 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2022-44641 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy