PT-2023-28883 · Unknown · Cx-Designer

Michael Heinzl · Published 2023-10-22 · Updated 2023-11-01 · CVE-2023-43624

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CX-Designer versions 3.740 and earlier

Description The issue concerns an improper restriction of XML external entity reference (XXE) vulnerability. If a user opens a specially crafted project file created by an attacker, sensitive information in the file system where CX-Designer is installed may be disclosed.

Recommendations For CX-Designer versions 3.740 and earlier, consider avoiding the use of XML external entity references until a patch is available. As a temporary workaround, restrict the opening of project files from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2023-43624

Affected Products

Cx-Designer

References · 7

• https://fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2023-011_en.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-43624 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43624 · Security Note
• https://twitter.com/CVEnew/status/1716322255863455872 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1716401584429519101 · Twitter Post
• https://jvn.jp/en/vu/JVNVU98683567 · Note
• https://t.me/cibsecurity/72758 · Telegram Post