PT-2023-6142 · Unknown · Vbase Automation Base

Kimiya · CVE-2022-43512 · Publicado 2023-03-21 · Atualizado 2025-01-17

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions VBASE Automation Base versions prior to 11.7.5

Description The issue is related to incorrect restriction of XML external entity references, which can lead to information disclosure when a valid user opens a specially crafted file. This may allow an attacker to cause a denial of service or gain unauthorized access to confidential data.

Recommendations For versions prior to 11.7.5, update to version 11.7.5 or later to resolve the issue. As a temporary workaround, consider restricting access to specially crafted files that could exploit the XML external entity processing vulnerability. Avoid using the DBConnections file parsing functionality until the issue is resolved.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2023-06848

CVE-2022-43512

ZDI-23-1041

Produtos afetados

Vbase Automation Base

Referências · 7

• https://osv.dev/vulnerability/CVE-2022-43512 · Aviso do Fabricante
• https://cisa.gov/news-events/ics-advisories/icsa-23-080-05 · Nota
• https://t.me/cvenotify/46602 · Publicação no Telegram
• https://t.me/cvenotify/46591 · Publicação no Telegram
• https://zerodayinitiative.com/advisories/ZDI-23-1041 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-06848 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2022-43512 · Nota de Segurança