CVE-2023-23595

Description

BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, such as "machine example.com login daniel password qwerty" in the documentation example for the .netrc file format. NOTE: 2.x versions are no longer supported. There is no available information about whether any later version is affected.

Weakness classification

• nvd@nist.gov: CWE-611
• 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-611

Primary references

• cve@mitre.org — Product, Vendor Advisory
• cve@mitre.org — Technical Description, Third Party Advisory
• cve@mitre.org — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Product, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Technical Description, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory