Vulnerability · Published Nov 8, 2023 · Assigned by NI
CVE-2023-5136Incorrect Permission Assignment in the TopoGrafix DataPlugin for GPX
Medium 5.5
In plain English
A medium-severity XML external entity in DIAdem from NI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.3%top 83.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NI | TopoGrafix DataPlugin for GPX | 0 – before 2023 Q4 |
| NI | DIAdem | 0 – before 2023 Q2 |
| NI | VeriStand | 0 – through 2023 Q4 |
| NI | FlexLogger | 0 – through 2023 Q4 |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N