CVE-2023-45727

CVE Published	2023-10-18
Related CWE(s)	CWE-611: Improper Restriction of XML External Entity Reference
Related Vendor(s)	northgrid
Related Product(s)	proself
Exploitation Reported (CISA KEV)	2024-12-03
CVSS 3 Base Score	7.5 (HIGH)
CVSS 3 Attack Complexity	LOW
CVSS 3 Attack Vector	NETWORK

Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.

Cyber Threat Graph Context

Explore how this CVE relates to the wider threat graph

Associated CAPEC Patterns

Data Serialization External Entities Blowup (CAPEC-221)

This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.

References

CVE-2023-45727

Cyber Threat Graph Context

Associated CAPEC Patterns

Data Serialization External Entities Blowup (CAPEC-221)

References

CVE.org

NIST National Vulnerability Database

CISA Known Exploited Vulnerabilities