CVE-2023-43624

CX-Designer Ver.3.740 and earlier (included in CX-One CXONE-AL[][]D-V4) contains an improper restriction of XML external entity reference (XXE) vulnerability. If a user opens a specially crafted project file created by an attacker, sensitive information in the file system where CX-Designer is installed may be disclosed.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://jvn.jp/en/vu/JVNVU98683567/	Third Party Advisory
https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2023-011_en.pdf	Vendor Advisory
https://jvn.jp/en/vu/JVNVU98683567/	Third Party Advisory
https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2023-011_en.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:omrom:cx-designer:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:24

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-23 05:15

Updated : 2024-11-21 08:24

NVD link : CVE-2023-43624

Mitre link : CVE-2023-43624

CVE.ORG link : CVE-2023-43624

JSON object : View

Products Affected

omrom

cx-designer

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2023-43624", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2023-10-23T05:15:07.877", "references": [{"url": "https://jvn.jp/en/vu/JVNVU98683567/", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2023-011_en.pdf", "tags": ["Vendor Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/vu/JVNVU98683567/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2023-011_en.pdf", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "CX-Designer Ver.3.740 and earlier (included in CX-One CXONE-AL[][]D-V4) contains an improper restriction of XML external entity reference (XXE) vulnerability. If a user opens a specially crafted project file created by an attacker, sensitive information in the file system where CX-Designer is installed may be disclosed."}, {"lang": "es", "value": "CX-Designer Ver.3.740 y anteriores (incluido en CX-One CXONE-AL[][]D-V4) contiene una restricci\u00f3n inadecuada de la vulnerabilidad de referencia de entidad externa XML (XXE). Si un usuario abre un archivo de proyecto especialmente manipulado creado por un atacante, se puede revelar informaci\u00f3n confidencial en el sistema de archivos donde est\u00e1 instalado CX-Designer."}], "lastModified": "2024-11-21T08:24:29.470", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:omrom:cx-designer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04FBE8C5-B31D-4F1E-B161-7A7084C0C592", "versionEndIncluding": "3.740"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}