Log in Start free

Vulnerability · Published Feb 16, 2023 · Assigned by cisco

CVE-2023-20052

Medium 5.3

In plain English

A medium-severity XML external entity in Cisco Secure Endpoint from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.0% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)7.0%top 5.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20clamav1.0.1-r0ALPINE-CVE-2023-20052
Alpine:v3.21clamav1.0.1-r0ALPINE-CVE-2023-20052
Alpine:v3.22clamav1.0.1-r0ALPINE-CVE-2023-20052
Alpine:v3.23clamav1.0.1-r0ALPINE-CVE-2023-20052
Alpine:v3.24clamav1.0.1-r0ALPINE-CVE-2023-20052
Debian:12clamav1.0.1+dfsg-1DEBIAN-CVE-2023-20052
Debian:13clamav1.0.1+dfsg-1DEBIAN-CVE-2023-20052
Debian:14clamav1.0.1+dfsg-1DEBIAN-CVE-2023-20052
Ubuntu:22.04:LTSclamav0.103.8+dfsg-0ubuntu0.22.04.1UBUNTU-CVE-2023-20052
Ubuntu:22.04:LTSclamav0.103.8+dfsg-0ubuntu0.22.04.1USN-5887-1

Affected products (as reported)

VendorProductVersions
Cisco Cisco Secure Endpoint 6.0.96.0.76.1.56.1.76.1.96.2.16.2.56.2.19

Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References