{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-45727", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2023-10-11T07:32:42.029Z", "datePublished": "2023-10-18T09:01:12.285Z", "dateUpdated": "2024-12-06T04:55:29.423Z"}, "containers": {"cna": {"affected": [{"vendor": "North Grid Corporation", "product": "Proself Enterprise/Standard Edition", "versions": [{"version": "Ver5.62 and earlier", "status": "affected"}]}, {"vendor": "North Grid Corporation", "product": "Proself Gateway Edition", "versions": [{"version": "Ver1.65 and earlier", "status": "affected"}]}, {"vendor": "North Grid Corporation", "product": "Proself Mail Sanitize Edition", "versions": [{"version": "Ver1.08 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker."}], "problemTypes": [{"descriptions": [{"description": "XML external entities (XXE)", "lang": "en", "type": "text"}]}], "references": [{"url": "https://www.proself.jp/information/153/"}, {"url": "https://jvn.jp/en/jp/JVN95981460/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2023-10-18T09:01:12.285Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:29:32.421Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.proself.jp/information/153/", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN95981460/", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-611", "lang": "en", "description": "CWE-611 Improper Restriction of XML External Entity Reference"}]}], "affected": [{"vendor": "northgrid", "product": "proself", "cpes": ["cpe:2.3:a:northgrid:proself:-:*:*:*:enterprise:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.62", "versionType": "custom"}]}, {"vendor": "northgrid", "product": "proself", "cpes": ["cpe:2.3:a:northgrid:proself:-:*:*:*:gateway:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.65", "versionType": "custom"}]}, {"vendor": "northgrid", "product": "proself", "cpes": ["cpe:2.3:a:northgrid:proself:-:*:*:*:standard:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.62", "versionType": "custom"}]}, {"vendor": "northgrid", "product": "proself", "cpes": ["cpe:2.3:a:northgrid:proself:-:*:*:*:mail_sanitize:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.08", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-12-05T00:00:00+00:00", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2023-45727"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2024-12-03", "reference": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-06T04:55:29.423Z"}, "timeline": [{"time": "2024-12-03T00:00:00+00:00", "lang": "en", "value": "CVE-2023-45727 added to CISA KEV"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.proself.jp/information/153/", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN95981460/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:29:32.421Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-45727", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-03T15:32:53.494856Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2024-12-03", "reference": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}}}], "affected": [{"cpes": ["cpe:2.3:a:northgrid:proself:-:*:*:*:enterprise:*:*:*"], "vendor": "northgrid", "product": "proself", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "5.62"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:northgrid:proself:-:*:*:*:gateway:*:*:*"], "vendor": "northgrid", "product": "proself", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.65"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:northgrid:proself:-:*:*:*:standard:*:*:*"], "vendor": "northgrid", "product": "proself", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "5.62"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:northgrid:proself:-:*:*:*:mail_sanitize:*:*:*"], "vendor": "northgrid", "product": "proself", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.08"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-13T15:14:19.772Z"}, "timeline": [{"lang": "en", "time": "2024-12-03T00:00:00+00:00", "value": "CVE-2023-45727 added to CISA KEV"}]}], "cna": {"affected": [{"vendor": "North Grid Corporation", "product": "Proself Enterprise/Standard Edition", "versions": [{"status": "affected", "version": "Ver5.62 and earlier"}]}, {"vendor": "North Grid Corporation", "product": "Proself Gateway Edition", "versions": [{"status": "affected", "version": "Ver1.65 and earlier"}]}, {"vendor": "North Grid Corporation", "product": "Proself Mail Sanitize Edition", "versions": [{"status": "affected", "version": "Ver1.08 and earlier"}]}], "references": [{"url": "https://www.proself.jp/information/153/"}, {"url": "https://jvn.jp/en/jp/JVN95981460/"}], "descriptions": [{"lang": "en", "value": "Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "XML external entities (XXE)"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2023-10-18T09:01:12.285Z"}}}, "cveMetadata": {"cveId": "CVE-2023-45727", "state": "PUBLISHED", "dateUpdated": "2024-12-06T04:55:29.423Z", "dateReserved": "2023-10-11T07:32:42.029Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2023-10-18T09:01:12.285Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}

{"cisaActionDue": "2024-12-24", "cisaExploitAdd": "2024-12-03", "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "cisaVulnerabilityName": "North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:northgrid:proself:*:*:*:*:mail_sanitize:*:*:*", "matchCriteriaId": "6D6F51B5-6B83-41C4-A1F6-9D10CB601DB5", "versionEndExcluding": "1.09", "vulnerable": true}, {"criteria": "cpe:2.3:a:northgrid:proself:*:*:*:*:gateway:*:*:*", "matchCriteriaId": "F1BB1954-50C1-40A8-9F47-415ECBB6259F", "versionEndExcluding": "1.66", "vulnerable": true}, {"criteria": "cpe:2.3:a:northgrid:proself:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "66942ECC-2DB7-4B63-9364-FC7D71722355", "versionEndExcluding": "5.63", "vulnerable": true}, {"criteria": "cpe:2.3:a:northgrid:proself:*:*:*:*:standard:*:*:*", "matchCriteriaId": "1ED1659B-802E-4F0F-9CF3-BD1BBED1A27F", "versionEndExcluding": "5.63", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker."}, {"lang": "es", "value": "Proself Enterprise/Standard Edition Ver5.62 y anteriores, Proself Gateway Edition Ver1.65 y anteriores, y Proself Mail Sanitize Edition Ver1.08 y anteriores permiten a un atacante remoto no autenticado realizar ataques de entidad externa XML (XXE). Al procesar una solicitud especialmente manipulada que contiene datos XML con formato incorrecto, el atacante puede leer archivos arbitrarios en el servidor que contienen informaci\u00f3n de la cuenta."}], "id": "CVE-2023-45727", "lastModified": "2024-12-06T02:00:01.520", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-10-18T10:15:08.643", "references": [{"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN95981460/"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://www.proself.jp/information/153/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN95981460/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.proself.jp/information/153/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "[email protected]", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-611"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}