CVE-2022-23990

moderate-risk

Published 2022-01-26

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Do I need to act?

3.5% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Libexpat

Nessus

Communications Metasolv Solution

Debian Linux

Fedora

Sinema Remote Connect Server

Debian Oracle Siemens Fedoraproject Libexpat Project Tenable

Patch https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf

Issue Tracking https://github.com/libexpat/libexpat/pull/551

Third Party Advisory https://security.gentoo.org/glsa/202209-24

Mailing List https://www.debian.org/security/2022/dsa-5073

Third Party Advisory https://www.oracle.com/security-alerts/cpuapr2022.html

Third Party Advisory https://www.tenable.com/security/tns-2022-05

Patch https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf

Issue Tracking https://github.com/libexpat/libexpat/pull/551

Third Party Advisory https://security.gentoo.org/glsa/202209-24

Mailing List https://www.debian.org/security/2022/dsa-5073

Third Party Advisory https://www.oracle.com/security-alerts/cpuapr2022.html

Third Party Advisory https://www.tenable.com/security/tns-2022-05

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 7/34 · Low

Exposure 14/34 · Moderate