CVE-2023-20052CWE-611

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0…

Medium · published February 16, 2023

CVSS v3.1
5.3
EPSS
7%
Percentile
94.2
In the wild
Unconfirmed
What it is

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:

A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device.

This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.07003 · 94.2th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2023-02-16T15:26Z
EPSS history
Timeline
  • 16 FEB 15:26Z
    On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0…
    cvelistv5