CVE-2023-45727

Description

Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.

References

https://www.securityweek.com/cisa-warns-of-zyxel-firewall-vulnerability-exploited-in-attacks/

https://securityaffairs.com/171638/security/u-s-cisa-adds-projectsend-north-grid-proself-and-zyxel-firewalls-bugs-to-its-known-exploited-vulnerabilities-catalog.html

https://thehackernews.com/2024/11/cisa-urges-agencies-to-patch-critical.html

https://www.cybereason.com/blog/cuckoo-spear-analyzing-noopdoor

https://www.proself.jp/information/153/

https://jvn.jp/en/jp/JVN95981460/

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3