CVE-2023-42035

2024-05-0303:15:36

CWE-611

[email protected]

web.nvd.nist.gov

visualware myconnection server

xxe

information disclosure

vulnerability

remote attackers

authentication

uri

xml parser

zdi-can-21774.

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

6.6 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

16.3%

JSON

Visualware MyConnection Server doIForward XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Visualware MyConnection Server. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the doIForward method. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-21774.

Affected configurations

Vulners

Node

visualwaremyconnection_serverRange≤11.3

CNA Affected

[
  {
    "vendor": "Visualware",
    "product": "MyConnection Server",
    "versions": [
      {
        "version": "11.3c",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]