CVE-2022-2414: Dogtag PKI XML parser allows XXE file disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 7.5 with no authentication or interaction required and a very high EPSS score, though no KEV listing or known exploit reference.

What it is

Dogtag PKI parses XML documents with external entity resolution enabled, exposing it to XML external entity (XXE) attacks. A remote attacker can send a crafted HTTP request to read arbitrary files from the server. The flaw is rated CVSS 7.5 (HIGH) with confidentiality impact only.

Impact

An attacker gains read access to arbitrary files on the host, which can expose credentials, configuration and key material. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network via HTTP requests to the XML-parsing endpoint; the vector shows no privileges (PR:N) and no user interaction (UI:N) required.

Exploitation

Not listed in CISA KEV and no public exploit reference is provided, but EPSS is very high (0.856, 99.7th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the patch referenced in dogtagpki/pki pull request 4021 and upgrade to a fixed release.
• Disable external entity and DTD processing in the XML parser used by the PKI service.
• Restrict network access to the affected HTTP endpoints to trusted clients only.
• Run the PKI service with least privilege and limit readable filesystem paths.
• Monitor for anomalous outbound requests or file-read patterns from the PKI host.

Detection

• Inspect HTTP request bodies to XML endpoints for DOCTYPE, ENTITY or SYSTEM/PUBLIC declarations.
• Alert on XML parser errors or unexpected file-read activity by the PKI process.
• Review server logs for requests containing external entity payloads or unusual parameter values.
• Baseline and monitor file access by the PKI service account for reads outside expected paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.