8.1
High
CVE-2023-37497 The Unica application exposes an API which accepts arbitrary XML input
Description
The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks (XXE) against the backend service.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| HCL Unica Platform 12.1 | earliest → < 12.1.1 | 12.1.1 |
Other CVEs of HCL Unica Platform
The 4 CVEs of HCL Unica Platform →
CVE-2023-37500
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform
8.1
High
CVE-2023-37499
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform
8.1
High
CVE-2023-37498
A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator
8.1
High