Vendor
Nokia
Vulnerable software
NetAct v 20.1
Severity level
Severity level: Medium
Impact: XML External Entity (XXE)
Access Vector: Remote
CVSS v3.1
Base Score: 5,8
Vector: (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/MAV:L/MAC:H/MPR:L/MUI:N/MS:U/MC:H/MI:L/MA:L)
CVE-2023-26058
Vulnerability description:
Input validation and proper XML parsers configuration was missing. On the Perfomance Manager+ page, attackers can import XML files. Support of external entities is enabled for processing of such files, which leads to Arbitrary File Read and SSRF. The attack can only be performed by an internal user. The vulnerability is fixed in NetAct 22 FP2211 and onwards.
Advisory status
10.10.2022 - Vendor gets vulnerability details
Credits
The vulnerability was detected by Vladimir Razov and Aleksandr Ustinov (Positive Technologies)
Get in touch
will contact you shortly