Skip to main content

Flexlogger CVE-2023-5136

MEDIUM
Improper Restriction of XML External Entity Reference (CWE-611)
2023-11-08 security@ni.com
Information Disclosure XXE Flexlogger Diadem Topografix Data Plugin Veristand Ni
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Nov 08, 2023 - 16:15 nvd
MEDIUM 5.5

DescriptionNVD

An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.

AnalysisAI

An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file. Affected products include: Ni Topografix Data Plugin, Ni Diadem, Ni Veristand, Ni Flexlogger.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Disable external entity processing in XML parsers, use JSON instead of XML where possible.

More in Flexlogger

View all
CVE-2024-1156 HIGH POC
7.8 Feb 20

Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ
CVE-2024-1155 HIGH POC
7.8 Feb 20

Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authentic
CVE-2025-2449 HIGH
8.8 Mar 18

NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability. Rated high severity (CVSS
CVE-2024-6121 HIGH
7.8 Jul 22

An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including

CVE-2022-27237 MEDIUM
6.1 Apr 21

There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Ra
CVE-2024-6122 MEDIUM
5.5 Jul 22

An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may r

Same weakness CWE-611 – Improper Restriction of XML External Entity Reference

View all
CVE-2019-9670 CRITICAL POC
9.8
CVE-2025-58360 HIGH POC
8.2
CVE-2025-2775 CRITICAL POC
9.3
CVE-2025-2776 CRITICAL POC
9.3
CVE-2017-12629 CRITICAL POC
9.8
CVE-2016-9563 MEDIUM POC
6.5
CVE-2012-3363 CRITICAL POC
9.1
CVE-2016-4264 HIGH POC
8.6

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2023-5136 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy