PatchTheCVEfme server vulnerabilities and fixes
Recent CVEs affecting fme server, with upgrade or downgrade steps. 5 tracked.
Also searched as: fmeserver.
fme server has 5 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 5. Most recent: 2023-06-23. Highest priority: CVE-2022-38340 (score 50/100).
- CVE-2023-35801 HIGH 8.1 UPGRADE A directory traversal vulnerability in Safe Software FME Server before 2022.2.5 allows an attacker to bypass v
- CVE-2022-38342 HIGH 8.5 UPGRADE Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a XML External Entity (XXE
- CVE-2022-38341 HIGH 7.1 UPGRADE Safe Software FME Server v2021.2.5 and below does not employ server-side validation.
- CVE-2022-38340 CRITICAL 9.1 UPGRADE Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerabi
- CVE-2022-38339 CRITICAL 9.6 UPGRADE Safe Software FME Server v2021.2.5, v2022.0.0.2 and below contains a cross-site scripting (XSS) vulnerability
FAQ
How do I fix fme server vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is fme server being exploited right now?
None of the tracked fme server CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which fme server CVE should I patch first?
CVE-2022-38340 currently ranks highest (50/100): Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerabi.