CVE-2023-28009

moderate-risk

Published 2023-04-26

HCL Workload Automation is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Do I need to act?

-

0.33% chance of exploitation

EPSS score — low exploit probability

-

Not on CISA KEV list

No confirmed active exploitation reported to CISA

?

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

6

CVSS 6.5/10 Medium

NETWORK / LOW complexity

Affected Products (14)

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Workload Automation

Affected Vendors

Hcltech

References (2)

Vendor Advisory https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0104371

Vendor Advisory https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0104371

43

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 1/34 · Minimal

Exposure 18/34 · Moderate