{"id":"CVE-2023-45727","published":"2023-10-18T10:15:08Z","modified":"2026-06-17T06:29:25Z","title":"North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability","vendor":"North Grid","product":"Proself","tier":"core","eol":null,"description":{"text":"Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.","provenance":"source","from":"NVD"},"summary":{"text":"The Proself product from North Grid contains an XML External Entity (XXE) flaw in its Enterprise/Standard Edition (up to and including Ver5.62), Gateway Edition (up to and including Ver1.65), and Mail Sanitize Edition (up to and including Ver1.08), where XML input is parsed without restricting external entity references. A remote attacker who has no authentication and needs no user interaction can send a specially crafted request containing malformed XML to read arbitrary files on the server, including files containing account information.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:06Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.04822,"percentile":0.91956,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-12-03","dueDate":"2024-12-24","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.proself.jp/information/153/ ; https://nvd.nist.gov/vuln/detail/CVE-2023-45727","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-09-13","exploitedFirstSeen":"2024-09-13","ransomware":false,"evidence":[{"url":"https://www.cybereason.com/blog/cuckoo-spear-analyzing-noopdoor","date":"2024-09-13"},{"url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html","date":"2024-11-19"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-12-03"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference"}],"references":[{"url":"https://jvn.jp/en/jp/JVN95981460/","tags":["Third Party Advisory"]},{"url":"https://www.proself.jp/information/153/","tags":["Vendor Advisory"]},{"url":"https://jvn.jp/en/jp/JVN95981460/","tags":["Third Party Advisory"]},{"url":"https://www.proself.jp/information/153/","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-45727","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: remote unauthenticated attack against public-facing web app","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks","start":156,"end":240}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: XXE reads arbitrary server files","mappingType":"primary_impact","evidence":[{"from":"description","quote":"arbitrary files on the server containing account information may be read","start":315,"end":387}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-d849a763c1dde7c77634","title":"Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella","publisher":"trendmicro.com","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html","date":"2024-11-19","mentions":[{"quote":"We observed that vulnerabilities of enterprise products, such as Array AG (CVE-2023-28461), Proself (CVE-2023-45727) and FortiOS/FortiProxy (CVE-2023-27997), were abused in the wild.","start":2002,"end":2184}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-50016","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-50016","exploited":true,"exploitedSince":"2024-12-03","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2023-10-18","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45727","provenance":"source"},{"date":"2024-09-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cybereason.com/blog/cuckoo-spear-analyzing-noopdoor","provenance":"source"},{"date":"2024-11-19","kind":"report","label":"Named in trendmicro.com: Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The…","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html","provenance":"machine"},{"date":"2024-12-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-12-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-50016","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":412},"priority":{"score":65.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 777 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.39,"detail":"percentile 0.9196"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}