Eclipse Leshan XXE Vulnerability (DDFFileParser) before 1.5.0 & 2.0.0-M13
CVE-2023-41034 Published on August 31, 2023
DDFFileParser in eclipse leshan is vulnerable to XXE Attacks
Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser` and `DefaultDDFFileValidator` (and so `ObjectLoader`) are vulnerable to `XXE Attacks`. A DDF file is a LWM2M format used to store LWM2M object description. Leshan users are impacted only if they parse untrusted DDF files (e.g. if they let external users provide their own model), in that case they MUST upgrade to fixed version. If you parse only trusted DDF file and validate only with trusted xml schema, upgrading is not mandatory. This issue has been fixed in versions 1.5.0 and 2.0.0-M13. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Vulnerability Analysis
CVE-2023-41034 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
What is a XXE Vulnerability?
The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVE-2023-41034 has been classified to as a XXE vulnerability or weakness.
Products Associated with CVE-2023-41034
Want to know whenever a new CVE is published for Eclipse Leshan? stack.watch will email you.
Affected Versions
eclipse-leshan leshan:- Version < 1.5.0 is affected.
- Version >= 2.0.0-M1, < 2.0.0-M13 is affected.
Vulnerable Packages
The following package name and versions may be associated with CVE-2023-41034
| Package Manager | Vulnerable Package | Versions | Fixed In |
|---|---|---|---|
| maven | org.eclipse.leshan:leshan-core | < 1.5.0 | 1.5.0 |
| maven | org.eclipse.leshan:leshan-core | >= 2.0.0-M1, < 2.0.0-M13 | 2.0.0-M13 |
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.