CVE-2023-23595

Katalog CVE

CVSS 7.5 · High EPSS 0,95%

Kerentanan Improper Restriction of XML External Entity Reference pada bluecatnetworks device registration portal. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, such as "machine example.com login daniel password qwerty" in the documentation example for the .netrc file format. NOTE: 2.x versions are no longer supported. There is no available information about whether any later version is affected.

Rincian

Terbit di NVD

15 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

EPSS (30 hari)

0,95% peluang dieksploitasi; lebih tinggi dari 60,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bluecatnetworks.com/integrations/adaptive-application/device-registration-portal-drp/ product · advisory vendor
• https://everything.curl.dev/usingcurl/netrc deskripsi teknis · advisory pihak ketiga
• https://github.com/colemanjp/XXE-Vulnerability-in-Bluecat-Device-Registration-Portal-DRP exploit · advisory pihak ketiga