CVE-2023-2806

A vulnerability classified as problematic was found in Weaver e-cology up to 9.0. Affected by this vulnerability is the function RequestInfoByXml of the component API. The manipulation leads to xml external entity reference. The associated identifier of this vulnerability is VDB-229411. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
References
Link Resource
https://github.com/Strangenees/e-cology/blob/main/main.md Exploit Third Party Advisory
https://vuldb.com/?ctiid.229411 Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?id.229411 Permissions Required Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:weaver:e-cology:9.0:*:*:*:*:*:*:*

History

26 May 2023, 18:13

Type Values Removed Values Added
References (MISC) https://vuldb.com/?ctiid.229411 - (MISC) https://vuldb.com/?ctiid.229411 - Permissions Required, Third Party Advisory, VDB Entry
References (MISC) https://vuldb.com/?id.229411 - (MISC) https://vuldb.com/?id.229411 - Permissions Required, Third Party Advisory, VDB Entry
References (MISC) https://github.com/Strangenees/e-cology/blob/main/main.md - (MISC) https://github.com/Strangenees/e-cology/blob/main/main.md - Exploit, Third Party Advisory
CPE cpe:2.3:a:weaver:e-cology:9.0:*:*:*:*:*:*:*
First Time Weaver e-cology
Weaver
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 8.8

19 May 2023, 09:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-05-19 09:15

Updated : 2024-03-21 02:47


NVD link : CVE-2023-2806

Mitre link : CVE-2023-2806

CVE.ORG link : CVE-2023-2806


JSON object : View

Products Affected

weaver

  • e-cology
CWE
CWE-611

Improper Restriction of XML External Entity Reference