CVE-2023-5136 — XML External Entity (XXE) Injection in Topografix Dataplugin FOR GPX

CWE-611 — XML External Entity (XXE) InjectionCWE-732 — Incorrect Permission Assignment2 documents2 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 70.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
NI DiademNI Topografix Dataplugin FOR GPXNI Flexlogger+2 more
Timeline
PublishedNov 8

Description

An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages8 packages

▶CVEListV5ni/diadem< 2023 Q2
▶CVEListV5ni/veristand2023 Q4
▶CVEListV5ni/flexlogger2023 Q4

🔴Vulnerability Details

1
GHSA
GHSA-mjm5-8p7x-r4cv: An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure↗2023-11-08
▶
CVE-2023-5136 — XML External Entity (XXE) Injection | cvebase