Lucene search

INCIBECVELIST:CVE-2023-6721

HistoryDec 13, 2023 - 10:06 a.m.

CVE-2023-6721 Improper Restriction of XML External Entity Reference in Repox

2023-12-1310:06:55

CWE-611

INCIBE

www.cve.org

repox

xee

fileupload

vulnerability

xml

data processing

server file system

8.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

8.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.8%

JSON

An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application’s XML data processing in the fileupload function, resulting in interaction between the attacker and the server’s file system.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Repox",
    "vendor": "Repox",
    "versions": [
      {
        "lessThanOrEqual": "2.3.7",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repox

8.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

8.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.8%

JSON

Related for CVELIST:CVE-2023-6721