CVE-2023-22377

Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClinical Metadata Desktop Tools Version 1.0.3 to Version 1.1.0. If this vulnerability is exploited, an attacker may obtain an arbitrary file which meets a certain condition by reading a specially crafted XML file.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/tsClinical/tsc-desktop/security/advisories	Third Party Advisory
https://jvn.jp/en/jp/JVN00712821/	Third Party Advisory
https://github.com/tsClinical/tsc-desktop/security/advisories	Third Party Advisory
https://jvn.jp/en/jp/JVN00712821/	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fujitsu:tsclinical_define.xml_generator::::::::
	cpe:2.3:a:fujitsu:tsclinical_metadata_desktop_tools::::::::

History

21 Nov 2024, 07:44

Type	Values Removed	Values Added
Summary		(es) Existe una restricción inadecuada de la vulnerabilidad de referencia de entidad externa XML (XXE) en tsClinical Define.xml Generator todas las versiones (v1.0.0 a v1.4.0) y tsClinical Metadata Desktop Tools versión 1.0.3 a versión 1.1.0. Si se aprovecha esta vulnerabilidad, un atacante puede obtener un archivo arbitrario que cumpla una determinada condición leyendo un archivo XML especialmente manipulado.
References	~~() https://github.com/tsClinical/tsc-desktop/security/advisories - Third Party Advisory~~	() https://github.com/tsClinical/tsc-desktop/security/advisories - Third Party Advisory
References	~~() https://jvn.jp/en/jp/JVN00712821/ - Third Party Advisory~~	() https://jvn.jp/en/jp/JVN00712821/ - Third Party Advisory

23 Feb 2023, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-02-15 01:15

Updated : 2025-03-19 18:15

NVD link : CVE-2023-22377

Mitre link : CVE-2023-22377

CVE.ORG link : CVE-2023-22377

JSON object : View

Products Affected

fujitsu

tsclinical_define.xml_generator
tsclinical_metadata_desktop_tools

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2023-22377", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "published": "2023-02-15T01:15:10.623", "references": [{"url": "https://github.com/tsClinical/tsc-desktop/security/advisories", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/jp/JVN00712821/", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://github.com/tsClinical/tsc-desktop/security/advisories", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://jvn.jp/en/jp/JVN00712821/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClinical Metadata Desktop Tools Version 1.0.3 to Version 1.1.0. If this vulnerability is exploited, an attacker may obtain an arbitrary file which meets a certain condition by reading a specially crafted XML file."}, {"lang": "es", "value": "Existe una restricci\u00f3n inadecuada de la vulnerabilidad de referencia de entidad externa XML (XXE) en tsClinical Define.xml Generator todas las versiones (v1.0.0 a v1.4.0) y tsClinical Metadata Desktop Tools versi\u00f3n 1.0.3 a versi\u00f3n 1.1.0. Si se aprovecha esta vulnerabilidad, un atacante puede obtener un archivo arbitrario que cumpla una determinada condici\u00f3n leyendo un archivo XML especialmente manipulado."}], "lastModified": "2025-03-19T18:15:19.503", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fujitsu:tsclinical_define.xml_generator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CD969AE-0F5A-47AA-AEC5-D09799E4CB84", "versionEndIncluding": "1.4.0", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:fujitsu:tsclinical_metadata_desktop_tools:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86E0D282-DB0B-4D98-903F-D491E88CE0A5", "versionEndExcluding": "1.1.1", "versionStartIncluding": "1.0.3"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}