CVE-2022-38342

MEDIUM 6.5CVE-2022-38342 · Published 13/09/2022 · updated 17/06/2026

In short

CVE-2022-38342 is a MEDIUM (CVSS 6.5) vulnerability affecting fme server (safe).
Chance of exploitation in the next 30 days (EPSS): 0.60%, higher than 49.0% of all vulnerabilities.
Fix: update to 2022.0.0.2, 2021.2.6.0 or later.

Package	Affected versions	Patched versions
fme server safe	`≥ 2022.0.0.0, < 2022.0.0.2< 2021.2.6.0`	`2022.0.0.22021.2.6.0`

Description

Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a XML External Entity (XXE) vulnerability which allows authenticated attackers to perform data exfiltration or Server-Side Request Forgery (SSRF) attacks.

References

community.safe.com/s/article/Known-Issue-FME-Server-XXE-vulnerability-via-adding-a-repository-item · Vendor Advisory
cycura.com/blog/safe-software-inc-fme-server-vulnerability-disclosure · Third Party Advisory

More vulnerabilities in fme server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

fme server

safe

≥ 2022.0.0.0, < 2022.0.0.2< 2021.2.6.0

2022.0.0.22021.2.6.0

More vulnerabilities in fme server

See all →