NorthGrid Proself XXE (CVE-2023-45727)

high Nessus Plugin ID 241641

Language:

Synopsis

The remote host is missing a security update.

Description

The version of NorthGrid Proself installed on the remote host is Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, or Proself Mail Sanitize Edition Ver1.08 and earlier. These versions allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to NorthGrid Proself Enterprise/Standard edition version 5.63 or later, Proself Gateway Edition version 1.66 or later, and Proself Mail Sanitize Edition version 1.09 or later.

Plugin Details

Severity: High

ID: 241641

File Name: northgrid_proself_cve-2023-45727.nasl

Version: 1.2

Type: local

Agent: windows, macosx, unix

Family: Misc.

Published: 7/9/2025

Updated: 7/10/2025

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2023-45727

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 7.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:northgrid:proself

Required KB Items: installed_sw/NorthGrid Proself

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/18/2023

Vulnerability Publication Date: 10/18/2023

CISA Known Exploited Vulnerability Due Dates: 12/24/2024

Reference Information

CVE: CVE-2023-45727

Detections

Analytics