CVE-2023-43624

low-risk
Published 2023-10-23

CX-Designer Ver.3.740 and earlier (included in CX-One CXONE-AL[][]D-V4) contains an improper restriction of XML external entity reference (XXE) vulnerability. If a user opens a specially crafted project file created by an attacker, sensitive information in the file system where CX-Designer is installed may be disclosed.

Do I need to act?

-
0.04% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (1)

Cx-Designer

Affected Vendors

Omrom

References (4)

Third Party Advisory https://jvn.jp/en/vu/JVNVU98683567/
Vendor Advisory https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2023-011_en.pdf
Third Party Advisory https://jvn.jp/en/vu/JVNVU98683567/
Vendor Advisory https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2023-011_en.pdf
23
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal