PT-2021-20003 · Panasonic · Panasonic Fpwin Pro

Michael Heinzl · Published 2021-07-09 · Updated 2021-07-13 · CVE-2021-32972

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Panasonic FPWIN Pro versions 7.5.1.1 and prior

Description The issue allows an attacker to craft a project file specifying a URI that causes the XML parser to access the URI and embed the contents, which may allow the attacker to disclose information that is accessible in the context of the user executing software.

Recommendations For versions 7.5.1.1 and prior, consider restricting access to project files and limiting the ability of the XML parser to access external URIs until a patch is available. As a temporary workaround, avoid using the XML parser to embed contents from external URIs in project files.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-32972

Affected Products

Panasonic Fpwin Pro

References · 4

• https://osv.dev/vulnerability/CVE-2021-32972 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32972 · Security Note
• https://t.me/cvenotify/17335 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-21-180-03 · Note