PT-2023-21596 · Independentsoft · Jodf

Dominique Righetto · Published 2023-03-24 · Updated 2023-03-30 · CVE-2023-28150

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Independentsoft JODF versions prior to 1.1.110

Description An issue was discovered in the API, which is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file. This allows for potential exploitation.

Recommendations For versions prior to 1.1.110, update to version 1.1.110 or later to resolve the issue. As a temporary workaround, consider restricting the processing of DOCX files from untrusted sources to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2023-28150

Affected Products

Jodf

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-28150 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28150 · Vendor Advisory
• https://t.me/cvenotify/46837 · Telegram Post
• https://t.me/cvenotify/47173 · Telegram Post
• https://excellium-services.com/cert-xlm-advisory/CVE-2023-28150 · Note
• https://independentsoft.de/jword/index.html · Note
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-28150 · Note