CVE-2023-5136
Incorrect Permission Assignment in the TopoGrafix DataPlugin for GPX
Severity Score
5.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track
*SSVC
Descriptions
An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.
Una asignación de permiso incorrecta en TopoGrafix DataPlugin para GPX podría resultar en la divulgación de información. Un atacante podría aprovechar esta vulnerabilidad haciendo que un usuario abra un archivo de datos especialmente manipulado.
This vulnerability allows remote attackers to disclose sensitive information on affected installations of NI DIAdem. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the processing of GPX files. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the current process.
*Credits:
kimiya
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-09-22 CVE Reserved
- 2023-11-08 CVE Published
- 2023-11-16 EPSS Updated
- 2024-10-10 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-611: Improper Restriction of XML External Entity Reference
- CWE-732: Incorrect Permission Assignment for Critical Resource
CAPEC
- CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Ni Search vendor "Ni" | Topografix Data Plugin Search vendor "Ni" for product "Topografix Data Plugin" | 2023 Search vendor "Ni" for product "Topografix Data Plugin" and version "2023" | gpx |
Affected
| ||||||
| Ni Search vendor "Ni" | Diadem Search vendor "Ni" for product "Diadem" | 2014 Search vendor "Ni" for product "Diadem" and version "2014" | - |
Affected
| ||||||
| Ni Search vendor "Ni" | Diadem Search vendor "Ni" for product "Diadem" | 2015 Search vendor "Ni" for product "Diadem" and version "2015" | - |
Affected
| ||||||
| Ni Search vendor "Ni" | Diadem Search vendor "Ni" for product "Diadem" | 2015 Search vendor "Ni" for product "Diadem" and version "2015" | sp2 |
Affected
| ||||||
| Ni Search vendor "Ni" | Diadem Search vendor "Ni" for product "Diadem" | 2017 Search vendor "Ni" for product "Diadem" and version "2017" | - |
Affected
| ||||||
| Ni Search vendor "Ni" | Diadem Search vendor "Ni" for product "Diadem" | 2017 Search vendor "Ni" for product "Diadem" and version "2017" | sp1 |
Affected
| ||||||
| Ni Search vendor "Ni" | Diadem Search vendor "Ni" for product "Diadem" | 2018 Search vendor "Ni" for product "Diadem" and version "2018" | - |
Affected
| ||||||
| Ni Search vendor "Ni" | Diadem Search vendor "Ni" for product "Diadem" | 2018 Search vendor "Ni" for product "Diadem" and version "2018" | sp1 |
Affected
| ||||||
| Ni Search vendor "Ni" | Diadem Search vendor "Ni" for product "Diadem" | 2019 Search vendor "Ni" for product "Diadem" and version "2019" | - |
Affected
| ||||||
| Ni Search vendor "Ni" | Diadem Search vendor "Ni" for product "Diadem" | 2019 Search vendor "Ni" for product "Diadem" and version "2019" | sp1 |
Affected
| ||||||
| Ni Search vendor "Ni" | Diadem Search vendor "Ni" for product "Diadem" | 2020 Search vendor "Ni" for product "Diadem" and version "2020" | - |
Affected
| ||||||
| Ni Search vendor "Ni" | Diadem Search vendor "Ni" for product "Diadem" | 2020 Search vendor "Ni" for product "Diadem" and version "2020" | sp1 |
Affected
| ||||||
| Ni Search vendor "Ni" | Diadem Search vendor "Ni" for product "Diadem" | 2021 Search vendor "Ni" for product "Diadem" and version "2021" | - |
Affected
| ||||||
| Ni Search vendor "Ni" | Diadem Search vendor "Ni" for product "Diadem" | 2021 Search vendor "Ni" for product "Diadem" and version "2021" | sp1 |
Affected
| ||||||
| Ni Search vendor "Ni" | Diadem Search vendor "Ni" for product "Diadem" | 2022 Search vendor "Ni" for product "Diadem" and version "2022" | q2 |
Affected
| ||||||
| Ni Search vendor "Ni" | Diadem Search vendor "Ni" for product "Diadem" | 2022 Search vendor "Ni" for product "Diadem" and version "2022" | q4 |
Affected
| ||||||
| Ni Search vendor "Ni" | Diadem Search vendor "Ni" for product "Diadem" | 2023 Search vendor "Ni" for product "Diadem" and version "2023" | q2 |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2013 Search vendor "Ni" for product "Veristand" and version "2013" | sp1 |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2014 Search vendor "Ni" for product "Veristand" and version "2014" | - |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2015 Search vendor "Ni" for product "Veristand" and version "2015" | - |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2015 Search vendor "Ni" for product "Veristand" and version "2015" | sp1 |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2016 Search vendor "Ni" for product "Veristand" and version "2016" | - |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2017 Search vendor "Ni" for product "Veristand" and version "2017" | - |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2018 Search vendor "Ni" for product "Veristand" and version "2018" | - |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2018 Search vendor "Ni" for product "Veristand" and version "2018" | sp1 |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2019 Search vendor "Ni" for product "Veristand" and version "2019" | - |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2019 Search vendor "Ni" for product "Veristand" and version "2019" | r2 |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2019 Search vendor "Ni" for product "Veristand" and version "2019" | r3 |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2019 Search vendor "Ni" for product "Veristand" and version "2019" | r3f1 |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2020 Search vendor "Ni" for product "Veristand" and version "2020" | - |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2020 Search vendor "Ni" for product "Veristand" and version "2020" | r2 |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2020 Search vendor "Ni" for product "Veristand" and version "2020" | r3 |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2020 Search vendor "Ni" for product "Veristand" and version "2020" | r4 |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2020 Search vendor "Ni" for product "Veristand" and version "2020" | r5 |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2020 Search vendor "Ni" for product "Veristand" and version "2020" | r6 |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2021 Search vendor "Ni" for product "Veristand" and version "2021" | - |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2021 Search vendor "Ni" for product "Veristand" and version "2021" | r2 |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2021 Search vendor "Ni" for product "Veristand" and version "2021" | r3 |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2023 Search vendor "Ni" for product "Veristand" and version "2023" | q1 |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2023 Search vendor "Ni" for product "Veristand" and version "2023" | q2 |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2023 Search vendor "Ni" for product "Veristand" and version "2023" | q3 |
Affected
| ||||||
| Ni Search vendor "Ni" | Veristand Search vendor "Ni" for product "Veristand" | 2023 Search vendor "Ni" for product "Veristand" and version "2023" | q4 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2018 Search vendor "Ni" for product "Flexlogger" and version "2018" | r1 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2018 Search vendor "Ni" for product "Flexlogger" and version "2018" | r2 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2018 Search vendor "Ni" for product "Flexlogger" and version "2018" | r3 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2018 Search vendor "Ni" for product "Flexlogger" and version "2018" | r4 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2019 Search vendor "Ni" for product "Flexlogger" and version "2019" | r1 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2019 Search vendor "Ni" for product "Flexlogger" and version "2019" | r2 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2019 Search vendor "Ni" for product "Flexlogger" and version "2019" | r3 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2019 Search vendor "Ni" for product "Flexlogger" and version "2019" | r4 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2020 Search vendor "Ni" for product "Flexlogger" and version "2020" | r1 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2020 Search vendor "Ni" for product "Flexlogger" and version "2020" | r2 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2020 Search vendor "Ni" for product "Flexlogger" and version "2020" | r3 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2020 Search vendor "Ni" for product "Flexlogger" and version "2020" | r4 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2021 Search vendor "Ni" for product "Flexlogger" and version "2021" | r1 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2021 Search vendor "Ni" for product "Flexlogger" and version "2021" | r2 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2021 Search vendor "Ni" for product "Flexlogger" and version "2021" | r3 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2021 Search vendor "Ni" for product "Flexlogger" and version "2021" | r4 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2022 Search vendor "Ni" for product "Flexlogger" and version "2022" | q2 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2022 Search vendor "Ni" for product "Flexlogger" and version "2022" | q4 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2023 Search vendor "Ni" for product "Flexlogger" and version "2023" | q1 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2023 Search vendor "Ni" for product "Flexlogger" and version "2023" | q2 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2023 Search vendor "Ni" for product "Flexlogger" and version "2023" | q3 |
Affected
| ||||||
| Ni Search vendor "Ni" | Flexlogger Search vendor "Ni" for product "Flexlogger" | 2023 Search vendor "Ni" for product "Flexlogger" and version "2023" | q4 |
Affected
| ||||||