CVE-2020-28387: siemens solid_edge

Vulnerability summary

CVE-2020-28387 is a medium (CVSS 5.5) vulnerability in siemens solid_edge. EPSS estimates a 0.92% chance of exploitation in the next 30 days, higher than 59.5% of scored vulnerabilities.

Timeline

1. 15-03-2021
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3). When opening a specially crafted SEECTCXML file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external dtd. (ZDI-CAN-11923)

• CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.