CVE-2023-37497

An XML External Entity (XXE) Injection Vulnerability affects HCL Unica Platform

High · published August 3, 2023

CVSS v3.1
8.1
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks (XXE) against the backend service.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00530 · 44.0th percentile
Published
2023-08-03T21:14Z
EPSS history
Timeline
  • 03 AUG 21:14Z
    An XML External Entity (XXE) Injection Vulnerability affects HCL Unica Platform
    cvelistv5