CVE-2019-17323 Code injection in REXPERT
Attackers can execute arbitrary code via malicious XML in the report print function, requiring user interaction to visit a malicious page.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-17323?
CVE-2019-17323 is a high-severity code injection vulnerability in ClipSoft REXPERT, published on 30 Oct 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation and execution via report print function of rexpert viewer with modified XML document. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
Weakness: CWE-91
Which versions are affected by CVE-2019-17323?
It affects 1 product.
Products include Clipsoft Rexpert.
How do I fix CVE-2019-17323?
No fix has been published for CVE-2019-17323 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-17323 being exploited?
There is no known exploitation of CVE-2019-17323 in the wild and no public exploit code.
Other vulnerabilities in ClipSoft REXPERT
Sources
Also known as GHSA-q8c5-p3cq-8mh2.