CVE-2023-28008

moderate-risk

Published 2023-04-26

HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Do I need to act?

-

0.56% chance of exploitation

EPSS score — low exploit probability

-

Not on CISA KEV list

No confirmed active exploitation reported to CISA

?

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

7

CVSS 7.1/10 High

NETWORK / LOW complexity

Affected Products (14)

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Affected Vendors

Hcltech

References (2)

Vendor Advisory https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0104371

Vendor Advisory https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0104371

45

/ 100

moderate-risk

Severity 25/34 · High

Exploitability 2/34 · Minimal

Exposure 18/34 · Moderate