CVE-2020-28387

CWE-611 — XML External Entity (XXE)3 documents3 sources
Severity
5.5MEDIUM
EPSS
0.2%
top 55.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Siemens Solid EdgeSiemens Solid Edge Se2020Siemens Solid Edge Se2021
Timeline
PublishedMar 15
Latest updateMay 24

Description

A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3). When opening a specially crafted SEECTCXML file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external dtd. (ZDI-CAN-11923)

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5siemens/solid_edge_se2020All Versions < SE2020MP13
▶CVEListV5siemens/solid_edge_se2021All Versions < SE2021MP3
▶NVDsiemens/solid_edge< se2021+1

🔴Vulnerability Details

2
GHSA
GHSA-cfhw-x225-jrhr: A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3)↗2022-05-24
▶
CVEList
CVE-2020-28387: A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3)↗2021-03-15
▶