Headline
CVE-2023-26058: PT-2022-02: XML External Entity (XXE)
An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input validation and a proper XML parser configuration are missing. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as Jsession-id, a CSRF token, and an Nxsrf token would be needed. The attack can realistically only be performed by an internal user.
Nokia
Vulnerable software
NetAct v 20.1
Severity level
Severity level: Medium
Impact: XML External Entity (XXE)
Access Vector: Remote
CVSS v3.1
Base Score: 5,8
Vector: (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/MAV:L/MAC:H/MPR:L/MUI:N/MS:U/MC:H/MI:L/MA:L)
CVE-2023-26058
Vulnerability description:
Input validation and proper XML parsers configuration was missing. On the Perfomance Manager+ page, attackers can import XML files. Support of external entities is enabled for processing of such files, which leads to Arbitrary File Read and SSRF. The attack can only be performed by an internal user. The vulnerability is fixed in NetAct 22 FP2211 and onwards.
Advisory status
10.10.2022 - Vendor gets vulnerability details
Credits
The vulnerability was detected by Vladimir Razov and Aleksandr Ustinov (Positive Technologies)