Novigest Desktop App
Monthly
XML External Entity (XXE) injection in the SAF-T import feature of the TACTiS NoviGest Desktop App allows an authenticated local user to read local files that are accessible to the application process by submitting a crafted SAF-T XML file. Only users who can reach and use the import function are affected (PR:L, AV:L per the CVSS:4.0 base vector, scored 8.3), and disclosure of sensitive system files specifically depends on the application running with elevated privileges. No public exploit code or confirmed active exploitation is associated with this CVE at time of analysis; INCIBE published the advisory and the issue is prioritized as remediation work for this week rather than an emergency.
The Java RMI service exposed by Tactis NoviGest Desktop App accepts remote method invocations on critical functions without verifying the caller, letting a network-positioned attacker reach stored credentials and issue arbitrary SQL against the application's PostgreSQL backend. Because the database account the application uses is described as holding elevated privileges, the SQL access can be chained into operating system command execution on the server, taking over confidentiality, integrity and availability. The defect is rated 9.4 under CVSS 4.0 and flagged act_now by vuln.today based on severity and breadth of impact, but no public exploit code has been identified at time of analysis and no CISA KEV listing exists; the practical barrier is network reachability to the RMI port, since a service bound to localhost or shielded by firewall rules is not remotely abusable. Note that the authentication requirement is not consistently described across sources - the narrative states critical RMI methods lack authentication, while the CVSS 4.0 vector asserts PR:L - so the exact precondition should be confirmed with the vendor.
XML External Entity (XXE) injection in the SAF-T import feature of the TACTiS NoviGest Desktop App allows an authenticated local user to read local files that are accessible to the application process by submitting a crafted SAF-T XML file. Only users who can reach and use the import function are affected (PR:L, AV:L per the CVSS:4.0 base vector, scored 8.3), and disclosure of sensitive system files specifically depends on the application running with elevated privileges. No public exploit code or confirmed active exploitation is associated with this CVE at time of analysis; INCIBE published the advisory and the issue is prioritized as remediation work for this week rather than an emergency.
The Java RMI service exposed by Tactis NoviGest Desktop App accepts remote method invocations on critical functions without verifying the caller, letting a network-positioned attacker reach stored credentials and issue arbitrary SQL against the application's PostgreSQL backend. Because the database account the application uses is described as holding elevated privileges, the SQL access can be chained into operating system command execution on the server, taking over confidentiality, integrity and availability. The defect is rated 9.4 under CVSS 4.0 and flagged act_now by vuln.today based on severity and breadth of impact, but no public exploit code has been identified at time of analysis and no CISA KEV listing exists; the practical barrier is network reachability to the RMI port, since a service bound to localhost or shielded by firewall rules is not remotely abusable. Note that the authentication requirement is not consistently described across sources - the narrative states critical RMI methods lack authentication, while the CVSS 4.0 vector asserts PR:L - so the exact precondition should be confirmed with the vendor.