CVE-2023-26057

An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page

Medium · published April 25, 2023

CVSS v3.1
6.5
EPSS
0%
Percentile
40.9
In the wild
Unconfirmed
What it is

An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page. Input validation and a proper XML parser configuration are missing. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as Jsession-id, a CSRF token, and an Nxsrf token would be needed. The attack can realistically only be performed by an internal user.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.00486 · 40.9th percentile
Published
2023-04-25T00:00Z
EPSS history
Timeline
  • 25 APR 00:00Z
    An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page
    cvelistv5