CVE-2022-45326

MEDIUM

Kwoksys Information Server < 2.9.5 - XXE

Title source: rule

Description

An XML external entity (XXE) injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks.

Exploits (1)

github WORKING POC

by navsec · pythonpoc

https://github.com/navsec/CVEs/tree/main/CVE-2022-45326

View Code ZIP pw:eip

References (2)

[Release Notes, Vendor Advisory] http://www.kwoksys.com/wiki/index.php?title=Release_Notes

[Exploit, Patch, Third Party Advisory] https://www.navsec.net/2022/11/12/kwoksys-xxe.html

Scores

CVSS v3 4.9

EPSS 0.0044

EPSS Percentile 63.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-611

Status published

Products (2)

kwoksys/information_server 2.9.5 sp23 (5 CPE variants)

kwoksys/information_server < 2.9.5

Published Dec 06, 2022

Tracked Since Feb 18, 2026