Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

CVE-2023-41034

Severity CVSS v4.0:
Pending analysis
Type:
CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
Publication date:
31/08/2023
Last modified:
21/11/2024

Description

Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser` and `DefaultDDFFileValidator` (and so `ObjectLoader`) are vulnerable to `XXE Attacks`. A DDF file is a LWM2M format used to store LWM2M object description. Leshan users are impacted only if they parse untrusted DDF files (e.g. if they let external users provide their own model), in that case they MUST upgrade to fixed version. If you parse only trusted DDF file and validate only with trusted xml schema, upgrading is not mandatory. This issue has been fixed in versions 1.5.0 and 2.0.0-M13. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact

Vector 3.x
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS v3.1 Severity and Metrics:

Base Score: 6.50 MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): Low
Availability (A): None

Base Score 3.x
6.50
Severity 3.x
MEDIUM

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:eclipse:leshan:*:*:*:*:*:*:*:* 1.5.0 (excluding)
cpe:2.3:a:eclipse:leshan:2.0.0:milestone1:*:*:*:*:*:*
cpe:2.3:a:eclipse:leshan:2.0.0:milestone10:*:*:*:*:*:*
cpe:2.3:a:eclipse:leshan:2.0.0:milestone11:*:*:*:*:*:*
cpe:2.3:a:eclipse:leshan:2.0.0:milestone12:*:*:*:*:*:*
cpe:2.3:a:eclipse:leshan:2.0.0:milestone2:*:*:*:*:*:*
cpe:2.3:a:eclipse:leshan:2.0.0:milestone3:*:*:*:*:*:*
cpe:2.3:a:eclipse:leshan:2.0.0:milestone4:*:*:*:*:*:*
cpe:2.3:a:eclipse:leshan:2.0.0:milestone5:*:*:*:*:*:*
cpe:2.3:a:eclipse:leshan:2.0.0:milestone6:*:*:*:*:*:*
cpe:2.3:a:eclipse:leshan:2.0.0:milestone7:*:*:*:*:*:*
cpe:2.3:a:eclipse:leshan:2.0.0:milestone8:*:*:*:*:*:*
cpe:2.3:a:eclipse:leshan:2.0.0:milestone9:*:*:*:*:*:*

To consult the complete list of CPE names with products and versions, see this page


References to Advisories, Solutions, and Tools