CVE-2023-22377

HIGH

7.4

Beschreibung

Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClinical Metadata Desktop Tools Version 1.0.3 to Version 1.1.0. If this vulnerability is exploited, an attacker may obtain an arbitrary file which meets a certain condition by reading a specially crafted XML file.

CVE Details

CVSS v3.1 Bewertung7.4

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

AngriffsvektorNETWORK

KomplexitatHIGH

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht2/15/2023

Zuletzt geandert3/19/2025

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

fujitsu:tsclinical_define.xml_generatorfujitsu:tsclinical_metadata_desktop_tools

Schwachen (CWE)

CWE-611CWE-611

Referenzen

https://github.com/tsClinical/tsc-desktop/security/advisories(vultures@jpcert.or.jp)

https://jvn.jp/en/jp/JVN00712821/(vultures@jpcert.or.jp)

https://github.com/tsClinical/tsc-desktop/security/advisories(af854a3a-2127-422b-91ae-364da2661108)

https://jvn.jp/en/jp/JVN00712821/(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.