Enterprise Architect
Monthly
XML External Entity injection in Sparx Systems Enterprise Architect's XSLT Debugger lets an attacker who convinces a user to open a crafted XML/XSLT file cause the parser to resolve an external DTD and disclose arbitrary files readable by the victim's Enterprise Architect process. The issue was reported by CERT-PL and has been confirmed only in version 17.1, with all other releases unverified because vendor contact attempts were unsuccessful; the CPE entry covers the product across all versions. It is unauthenticated in the network sense but requires the victim to actively load attacker-controlled content into the debugger (UI:A in the CVSS v4.0 vector, UI:R in our CVSS v3.1 assessment), confidentiality-only impact with no write or code execution demonstrated from this flaw alone, and no public exploit identified at time of analysis.
Privilege escalation in Sparx Enterprise Architect 17.1 and earlier allows an authenticated low-privilege user to impersonate any other user, including administrators, by tampering with the client-side application (e.g., via a debugger). Because role-based access enforcement happens in the client rather than on the server (CWE-603), an attacker who has any valid login can gain full repository control. No public exploit identified at time of analysis, although technical write-ups are referenced.
XML External Entity injection in Sparx Systems Enterprise Architect's XSLT Debugger lets an attacker who convinces a user to open a crafted XML/XSLT file cause the parser to resolve an external DTD and disclose arbitrary files readable by the victim's Enterprise Architect process. The issue was reported by CERT-PL and has been confirmed only in version 17.1, with all other releases unverified because vendor contact attempts were unsuccessful; the CPE entry covers the product across all versions. It is unauthenticated in the network sense but requires the victim to actively load attacker-controlled content into the debugger (UI:A in the CVSS v4.0 vector, UI:R in our CVSS v3.1 assessment), confidentiality-only impact with no write or code execution demonstrated from this flaw alone, and no public exploit identified at time of analysis.
Privilege escalation in Sparx Enterprise Architect 17.1 and earlier allows an authenticated low-privilege user to impersonate any other user, including administrators, by tampering with the client-side application (e.g., via a debugger). Because role-based access enforcement happens in the client rather than on the server (CWE-603), an attacker who has any valid login can gain full repository control. No public exploit identified at time of analysis, although technical write-ups are referenced.