Vulnerability Description
Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClinical Metadata Desktop Tools Version 1.0.3 to Version 1.1.0. If this vulnerability is exploited, an attacker may obtain an arbitrary file which meets a certain condition by reading a specially crafted XML file.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fujitsu | Tsclinical Define.Xml Generator | >= 1.0.0, <= 1.4.0 |
| Fujitsu | Tsclinical Metadata Desktop Tools | >= 1.0.3, < 1.1.1 |
Related Weaknesses (CWE)
References
- https://github.com/tsClinical/tsc-desktop/security/advisoriesThird Party Advisory
- https://jvn.jp/en/jp/JVN00712821/Third Party Advisory
- https://github.com/tsClinical/tsc-desktop/security/advisoriesThird Party Advisory
- https://jvn.jp/en/jp/JVN00712821/Third Party Advisory
FAQ
What is CVE-2023-22377?
CVE-2023-22377 is a vulnerability with a CVSS score of 7.4 (HIGH). Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClinical Metadata Desktop Tools Version 1.0.3 ...
How severe is CVE-2023-22377?
CVE-2023-22377 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-22377?
Check the references section above for vendor advisories and patch information. Affected products include: Fujitsu Tsclinical Define.Xml Generator, Fujitsu Tsclinical Metadata Desktop Tools.