PT-2024-13703 · Stilog · Stilog Visual Planning

David Brown + 1 · Published 2024-03-29 · Updated 2025-03-27 · CVE-2023-49234

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Stilog Visual Planning version 8

Description An XML external entity (XXE) vulnerability was found in the software. It allows an authenticated attacker to access local server files and exfiltrate data to an external server.

Recommendations For Stilog Visual Planning version 8, consider disabling XML external entities or restricting access to sensitive files as a temporary workaround until a patch is available.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2023-49234

Affected Products

Stilog Visual Planning

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-49234 · Security Note
• https://visual-planning.com/en/support-portal/updates · Note
• https://t.me/cvenotify/75845 · Telegram Post
• https://t.me/cvenotify/116590 · Telegram Post
• http://seclists.org/fulldisclosure/2024/Apr/3 · Note
• https://schutzwerk.com/advisories/SCHUTZWERK-SA-2023-006.txt · Note
• https://schutzwerk.com/blog/schutzwerk-sa-2023-006 · Note
• https://t.me/cvenotify/75151 · Telegram Post
• https://twitter.com/CVEnew/status/1773842631786959170 · Twitter Post