8.1
Élevée
CVE-2023-37497 The Unica application exposes an API which accepts arbitrary XML input
Description
The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks (XXE) against the backend service.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| HCL Unica Platform 12.1 | premières → < 12.1.1 | 12.1.1 |
Autres CVE de HCL Unica Platform
Les 4 CVE de HCL Unica Platform →
CVE-2023-37500
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform
8.1
Élevée
CVE-2023-37499
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform
8.1
Élevée
CVE-2023-37498
A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator
8.1
Élevée