PT-2023-5484 · Phoenix Contact · Tc Cloud Client+2

A. Resanovic

+2

·

Publicado

2023-08-08

·

Atualizado

2023-08-14

·

CVE-2023-3569

CVSS v2.0

6.1

Média

VetorAV:N/AC:L/Au:M/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions PHOENIX CONTACT TC ROUTER versions prior to 2.07.2 PHOENIX CONTACT TC CLOUD CLIENT versions prior to 2.07.2 PHOENIX CONTACT CLOUD CLIENT 1101T-TX/TX versions prior to 2.06.10
Description The issue is related to the incorrect restriction of XML links to external objects in PHOENIX CONTACT's TC ROUTER and TC CLOUD CLIENT. An authenticated remote attacker with admin privileges could upload a crafted XML file, causing a denial-of-service.
Recommendations For PHOENIX CONTACT TC ROUTER versions prior to 2.07.2, update to version 2.07.2 or later. For PHOENIX CONTACT TC CLOUD CLIENT versions prior to 2.07.2, update to version 2.07.2 or later. For PHOENIX CONTACT CLOUD CLIENT 1101T-TX/TX versions prior to 2.06.10, update to version 2.06.10 or later.

Correção

XML Entity Expansion

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-776

Identificadores relacionados

BDU:2023-06130
CVE-2023-3569

Produtos afetados

Cloud Client 1101T-Tx/Tx
Tc Cloud Client
Tc Router