CVE-2023-45727

Description

Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.

Reserved 2023-10-11 | Published 2023-10-18 | Updated 2024-12-06 | Assigner jpcert

CISA Known Exploited Vulnerability

Date added 2024-12-03 | Due date 2024-12-24

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Problem types

XML external entities (XXE)

Product status

Ver5.62 and earlier
affected

Ver1.65 and earlier
affected

Ver1.08 and earlier
affected

References

www.proself.jp/information/153/

jvn.jp/en/jp/JVN95981460/

cve.org (CVE-2023-45727)

nvd.nist.gov (CVE-2023-45727)

Download JSON