HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
References
| Link | Resource |
|---|---|
| https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0104371 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
05 May 2023, 20:28
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Hcltech
Hcltech workload Automation |
|
| CWE | CWE-611 | |
| References | (MISC) https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0104371 - Vendor Advisory | |
| CPE | cpe:2.3:a:hcltech:workload_automation:9.5.0:fix_pack_3:*:*:*:*:*:* cpe:2.3:a:hcltech:workload_automation:9.5.0:fix_pack_5:*:*:*:*:*:* cpe:2.3:a:hcltech:workload_automation:9.5.0:-:*:*:*:*:*:* cpe:2.3:a:hcltech:workload_automation:10.1.0:-:*:*:*:*:*:* cpe:2.3:a:hcltech:workload_automation:9.5.0:fix_pack_6:*:*:*:*:*:* cpe:2.3:a:hcltech:workload_automation:9.4.0:fix_pack_4:*:*:*:*:*:* cpe:2.3:a:hcltech:workload_automation:9.5.0:fix_pack_1:*:*:*:*:*:* cpe:2.3:a:hcltech:workload_automation:9.4.0:fix_pack_3:*:*:*:*:*:* cpe:2.3:a:hcltech:workload_automation:9.4.0:-:*:*:*:*:*:* cpe:2.3:a:hcltech:workload_automation:9.5.0:fix_pack_2:*:*:*:*:*:* cpe:2.3:a:hcltech:workload_automation:9.4.0:fix_pack_5:*:*:*:*:*:* cpe:2.3:a:hcltech:workload_automation:9.4.0:fix_pack_6:*:*:*:*:*:* cpe:2.3:a:hcltech:workload_automation:9.5.0:fix_pack_4:*:*:*:*:*:* cpe:2.3:a:hcltech:workload_automation:9.4.0:fix_pack_7:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
26 Apr 2023, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-26 20:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-28008
Mitre link : CVE-2023-28008
CVE.ORG link : CVE-2023-28008
JSON object : View
Products Affected
hcltech
- workload_automation
CWE
CWE-611
Improper Restriction of XML External Entity Reference