Vendor
Nokia
Vulnerable software
NetAct v 20.1
Severity level
Severity level: Medium
Impact: XML External Entity (XXE)
Access Vector: Remote
CVSS v3.1
Base Score: 5,8
Vector: (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/MAV:L/MAC:H/MPR:L/MUI:N/MS:U/MC:H/MI:L/MA:L)
CVE-2023-26057
Vulnerability description:
Input validation and proper XML parsers configuration was missing. On the Configuration Dashboard page, an attacker can import XML files. Support of external entities (External Entity) is enabled for processing of such files, which leads to Arbitrary File Read and SSRF. The attack can only be performed by an internal user. The vulnerability is fixed in NetAct 22 FP2211 and onwards.
Advisory status
10.10.2022 - Vendor gets vulnerability details
Credits
The vulnerability was detected by Vladimir Razov and Aleksandr Ustinov (Positive Technologies)
Get in touch
will contact you shortly