CVE-2022-47950Medium· 6.5▾ SunlitOpenStack Swift XML external entities (XXE) Injection
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.0%
1.0% → 1.0%
An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).
swift < 2.28.1swift >= 2.29.0, < 2.29.2swift >= 2.30.0, < 2.30.1Upgrade to a patched release:
swift 2.28.1swift 2.29.2swift 2.30.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-49017HighOpenStack Swift: s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body
CVE-2013-4155MediumOpenStack Swift allows authenticated users to cause a denial of service
CVE-2015-5223MediumOpenStack Object Storage (Swift) Sensitive Data Exposure
CVE-2014-7960MediumOpenStack Swift metadata constraints are not correctly enforced
CVE-2016-0738High· 7.5OpenStack Object Storage (Swift) allows remote attackers to cause a denial of service
CVE-2015-1856MediumOpenStack Swift Unauthorized delete of versioned Swift object