PT-2023-16863 · Dsm · Enovia Live Collaboration

Shadi Habbal · Publicado 2023-03-09 · Atualizado 2023-03-21 · CVE-2023-1288

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ENOVIA Live Collaboration version V6R2013xE

Description An XML External Entity injection (XXE) vulnerability allows an attacker to read local files on the server, which can also lead to Remote File inclusions.

Recommendations For ENOVIA Live Collaboration version V6R2013xE, consider disabling XML External Entity processing to prevent XXE attacks until a patch is available. Restrict access to sensitive files on the server to minimize the risk of exploitation.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2023-1288

Produtos afetados

Enovia Live Collaboration

Referências · 6

• https://3ds.com/vulnerability/advisories · Aviso do Fabricante
• https://t.me/cvenotify/45868 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-1288 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-1288 · Nota de Segurança
• https://t.me/cibsecurity/59738 · Publicação no Telegram
• https://t.me/cvenotify/45879 · Publicação no Telegram