CVE-2023-49234

medium

Description

An XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8. It allows an authenticated attacker to access local server files and exfiltrate data to an external server.

References

https://www.visual-planning.com/en/support-portal/updates

https://www.schutzwerk.com/blog/schutzwerk-sa-2023-006/

https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2023-006.txt

http://seclists.org/fulldisclosure/2024/Apr/3

Details

Source: Mitre, NVD

Published: 2024-03-29

Updated: 2026-04-15

Risk Information

CVSS v2

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 6.3

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N