CVE-2023-46502: Improper Restriction of XML External Entity Reference

October 30, 2023 (updated November 6, 2023)

An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory.

References

gist.github.com/spookhorror/9519fc66d3946e887e4a86c06ddbee0e
github.com/opencrx/opencrx/commit/ce7a71db0bb34ecbcb0e822d40598e410a48b399
nvd.nist.gov/vuln/detail/CVE-2023-46502

Code Behaviors & Features

Detect and mitigate CVE-2023-46502 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →