CVE-2022-48565

An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

5.07% chance of exploitation in the next 30 days, 92th percentile

Published

2023-08-22

Updated

2024-10-03

Proof-of-concept exploits (2)

• Einstein2150/CVE-2022-48565-POC3★ · 2024-10-28
• Einstein2150/CVE-2022-48656-POC3★ · 2024-10-28

References

• CVE Record
• NVD entry

Related

• CVE-2022-48656
• CVE-2022-48560
• CVE-2022-4857
• CVE-2022-4856
• CVE-2022-48612
• CVE-2022-48554