CVE-2023-45727 North Grid Proself Improper Restriction of XML External Entity (XXE) Reference
Remote unauthenticated attackers can read arbitrary files containing account information via XML External Entity attacks in Proself server editions.
- Exploited in the wild
- Since 3 Dec 2024
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-45727?
CVE-2023-45727 is a high-severity vulnerability in North Grid Corporation Proself Enterprise/Standard Edition, published on 18 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.
Weakness: CWE-611
Which versions are affected by CVE-2023-45727?
It affects 1 product.
Products include Northgrid Proself.
How do I fix CVE-2023-45727?
No fix has been published for CVE-2023-45727 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 24 Dec 2024.
Is CVE-2023-45727 being exploited?
Yes. Attackers have exploited CVE-2023-45727 in the wild since at least 3 Dec 2024.
Other vulnerabilities in North Grid Corporation Proself Enterprise/Standard Edition
Sources
Also known as GHSA-m745-jcvj-8cx6.