PT-2023-28883 · Unknown · Cx-Designer

Michael Heinzl · CVE-2023-43624 · Publicado 2023-10-22 · Atualizado 2023-11-01

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CX-Designer versions 3.740 and earlier

Description The issue concerns an improper restriction of XML external entity reference (XXE) vulnerability. If a user opens a specially crafted project file created by an attacker, sensitive information in the file system where CX-Designer is installed may be disclosed.

Recommendations For CX-Designer versions 3.740 and earlier, consider avoiding the use of XML external entity references until a patch is available. As a temporary workaround, restrict the opening of project files from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2023-43624

Produtos afetados

Cx-Designer

Referências · 7

• https://twitter.com/CVEnew/status/1716322255863455872 · Publicação no Twitter
• https://fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2023-011_en.pdf · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1716401584429519101 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-43624 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-43624 · Nota de Segurança
• https://jvn.jp/en/vu/JVNVU98683567 · Nota
• https://t.me/cibsecurity/72758 · Publicação no Telegram