Embed Notice

How is Github doing CVSS scoring? I was looking at CVE-2022-41966 and it has a CVSS vector that indicates Integrity: Low.

The vulnerability allows an attacker who can feed malicious data to an XML deserialiser to crash the parser with a StackOverflowError. The fix changes this to a different type of exception. How can that in any way be marked as having an integrity impact at all?

I note that the NIST assessment has the much more appropriate assessment here where there is no impact of integrity.

#infosec #cve