PT-2023-16863 · Dsm · Enovia Live Collaboration

Shadi Habbal · Published 2023-03-09 · Updated 2023-03-21 · CVE-2023-1288

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ENOVIA Live Collaboration version V6R2013xE

Description An XML External Entity injection (XXE) vulnerability allows an attacker to read local files on the server, which can also lead to Remote File inclusions.

Recommendations For ENOVIA Live Collaboration version V6R2013xE, consider disabling XML External Entity processing to prevent XXE attacks until a patch is available. Restrict access to sensitive files on the server to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2023-1288

Affected Products

Enovia Live Collaboration

References · 6

• https://3ds.com/vulnerability/advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-1288 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1288 · Security Note
• https://t.me/cvenotify/45868 · Telegram Post
• https://t.me/cibsecurity/59738 · Telegram Post
• https://t.me/cvenotify/45879 · Telegram Post