XXE Vulnerability in Proself Enterprise <=5.62 & Gateway <=1.65 / Mail <=1.08
CVE-2023-45727 Published on October 18, 2023
Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.
Known Exploited Vulnerability
This North Grid Proself Improper Restriction of XML External Entity (XEE) Reference Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack.
The following remediation steps are recommended / required by December 24, 2024: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vulnerability Analysis
CVE-2023-45727 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. This vulnerability is known to be actively exploited by threat actors in an automatable fashion. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is a XXE Vulnerability?
The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVE-2023-45727 has been classified to as a XXE vulnerability or weakness.
Products Associated with CVE-2023-45727
Want to know whenever a new CVE is published for Northgrid Proself? stack.watch will email you.
Affected Versions
North Grid Corporation Proself Enterprise/Standard Edition:- Version Ver5.62 and earlier is affected.
- Version Ver1.65 and earlier is affected.
- Version Ver1.08 and earlier is affected.
- Before and including 5.62 is affected.
- Before and including 1.65 is affected.
- Before and including 5.62 is affected.
- Before and including 1.08 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.