Opencrx CVE-2023-46502

CRITICAL

Improper Restriction of XML External Entity Reference (CWE-611)

2023-10-30 cve@mitre.org

SSRF XXE Opencrx

9.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Oct 30, 2023 - 23:15 nvd

CRITICAL 9.8

DescriptionNVD

An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory.

AnalysisAI

An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.

Technical ContextAI

This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory. Affected products include: Opencrx.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Disable external entity processing in XML parsers, use JSON instead of XML where possible.

More in Opencrx

View all

CVE-2020-7378 CRITICAL Act Now POC

CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. Rated cr

CVE-2023-40817 MEDIUM This Month POC

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field. Rated medium severity (C

CVE-2023-40816 MEDIUM This Month POC

OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field. Rated medium severity (CVSS 6.1

CVE-2023-40815 MEDIUM This Month POC

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field. Rated medium severity (CVSS

CVE-2023-40814 MEDIUM This Month POC

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field. Rated medium severity (CVSS 6.1), thi

CVE-2023-40813 MEDIUM This Month POC

OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation. Rated medium severity (CVSS 6.

CVE-2023-40812 MEDIUM This Month POC

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field. Rated medium severity (CVSS 6.1

CVE-2023-40810 MEDIUM This Month POC

OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field. Rated medium severity (CVSS 6.1), this vul

CVE-2023-40809 MEDIUM This Month POC

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number. Rated medium sev

CVE-2023-27150 MEDIUM This Month POC

openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of

CVE-2022-40084 MEDIUM This Month POC

OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages re

CVE-2021-25959 MEDIUM This Month

In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized pa

Same weakness CWE-611 – Improper Restriction of XML External Entity Reference

View all

CVE-2019-9670 CRITICAL POC

CVE-2025-58360 HIGH POC

CVE-2025-2775 CRITICAL POC

CVE-2025-2776 CRITICAL POC

CVE-2017-12629 CRITICAL POC

CVE-2016-9563 MEDIUM POC

CVE-2012-3363 CRITICAL POC

CVE-2016-4264 HIGH POC

Same technique SSRF

View all

CVE-2016-3718 MEDIUM POC

CVE-2015-8813 HIGH POC

CVE-2020-24881 CRITICAL POC

CVE-2026-15409 CRITICAL POC

CVE-2024-54385 HIGH POC

CVE-2022-45835 MEDIUM POC

CVE-2024-54330 HIGH POC

CVE-2026-20230 HIGH POC

Share

CVE-2023-46502 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy