Search for vulnerabilities
Vulnerability details: VCID-us2h-627w-aaab
Vulnerability ID VCID-us2h-627w-aaab
Aliases CVE-2022-23476
GHSA-qv4q-mr5r-qprj
Summary Unchecked return value from xmlTextReaderExpand
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-476 NULL Pointer Dereference
CWE-252 Unchecked Return Value
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23476.json
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00083 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00121 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00121 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00121 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00121 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00121 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00121 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00121 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00121 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00121 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00121 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00121 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00121 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00121 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00121 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00121 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
epss 0.00436 https://api.first.org/data/v1/epss?cve=CVE-2022-23476
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-qv4q-mr5r-qprj
cvssv3.1 8.2 https://github.com/sparklemotion/nokogiri
generic_textual HIGH https://github.com/sparklemotion/nokogiri
cvssv3.1 7.5 https://github.com/sparklemotion/nokogiri/commit/85410e38410f670cbbc8c5b00d07b843caee88ce
generic_textual HIGH https://github.com/sparklemotion/nokogiri/commit/85410e38410f670cbbc8c5b00d07b843caee88ce
ssvc Track https://github.com/sparklemotion/nokogiri/commit/85410e38410f670cbbc8c5b00d07b843caee88ce
cvssv3.1 7.5 https://github.com/sparklemotion/nokogiri/commit/9fe0761c47c0d4270d1a5220cfd25de080350d50
generic_textual HIGH https://github.com/sparklemotion/nokogiri/commit/9fe0761c47c0d4270d1a5220cfd25de080350d50
ssvc Track https://github.com/sparklemotion/nokogiri/commit/9fe0761c47c0d4270d1a5220cfd25de080350d50
cvssv3.1 7.5 https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qv4q-mr5r-qprj
cvssv3.1_qr HIGH https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qv4q-mr5r-qprj
ssvc Track https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qv4q-mr5r-qprj
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-23476
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-23476
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23476.json
https://api.first.org/data/v1/epss?cve=CVE-2022-23476
https://github.com/sparklemotion/nokogiri
https://github.com/sparklemotion/nokogiri/commit/85410e38410f670cbbc8c5b00d07b843caee88ce
https://github.com/sparklemotion/nokogiri/commit/9fe0761c47c0d4270d1a5220cfd25de080350d50
2153279 https://bugzilla.redhat.com/show_bug.cgi?id=2153279
cpe:2.3:a:nokogiri:nokogiri:1.13.8:*:*:*:*:ruby:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:nokogiri:nokogiri:1.13.8:*:*:*:*:ruby:*:*
cpe:2.3:a:nokogiri:nokogiri:1.13.9:*:*:*:*:ruby:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:nokogiri:nokogiri:1.13.9:*:*:*:*:ruby:*:*
CVE-2022-23476 https://nvd.nist.gov/vuln/detail/CVE-2022-23476
CVE-2022-23476.YML https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-23476.yml
GHSA-qv4q-mr5r-qprj https://github.com/advisories/GHSA-qv4q-mr5r-qprj
GHSA-qv4q-mr5r-qprj https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qv4q-mr5r-qprj
GLSA-202408-13 https://security.gentoo.org/glsa/202408-13
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23476.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H Found at https://github.com/sparklemotion/nokogiri
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/sparklemotion/nokogiri/commit/85410e38410f670cbbc8c5b00d07b843caee88ce
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:48:08Z/ Found at https://github.com/sparklemotion/nokogiri/commit/85410e38410f670cbbc8c5b00d07b843caee88ce
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/sparklemotion/nokogiri/commit/9fe0761c47c0d4270d1a5220cfd25de080350d50
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:48:08Z/ Found at https://github.com/sparklemotion/nokogiri/commit/9fe0761c47c0d4270d1a5220cfd25de080350d50
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qv4q-mr5r-qprj
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:48:08Z/ Found at https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qv4q-mr5r-qprj
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-23476
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-23476
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.25501
EPSS Score 0.00083
Published At May 1, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.