Is CVE-2023-45727 exploited in the wild?

Yes. CVE-2023-45727 is known to be exploited in the wild, first recorded on 3 December 2024. Treat it as urgent.

How severe is CVE-2023-45727?

Critical severity, with a CVSS score of 7.5, published 3 December 2024.

Which products and versions are affected?

North Grid Proself Enterprise Edition Ver5.62 and earlier; North Grid Proself Standard Edition Ver5.62 and earlier; North Grid Proself Gateway Edition Ver1.65 and earlier; North Grid Proself Mail Sanitize Edition Ver1.08 and earlier.

Is there a fix for CVE-2023-45727?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2023-45727 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2023-45727?

Check whether you run North Grid ProSelf. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-45727: North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability

CVE-2023-45727 · Severity: critical · CVSS 7.5 · Exploited in the wild · Published 2024-12-03

North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize editions contain an XML External Entity (XXE) vulnerability. A remote, unauthenticated attacker can send a specially crafted XML request to read arbitrary files on the server, potentially exposing sensitive account information.

Quick answers

Is CVE-2023-45727 exploited in the wild?: Yes. CVE-2023-45727 is known to be exploited in the wild, first recorded on 3 December 2024. Treat it as urgent.
How severe is CVE-2023-45727?: Critical severity, with a CVSS score of 7.5, published 3 December 2024.
Which products and versions are affected?: North Grid Proself Enterprise Edition Ver5.62 and earlier; North Grid Proself Standard Edition Ver5.62 and earlier; North Grid Proself Gateway Edition Ver1.65 and earlier; North Grid Proself Mail Sanitize Edition Ver1.08 and earlier.
Is there a fix for CVE-2023-45727?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2023-45727 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2023-45727?: Check whether you run North Grid ProSelf. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

North Grid Proself Enterprise Edition Ver5.62 and earlier
North Grid Proself Standard Edition Ver5.62 and earlier
North Grid Proself Gateway Edition Ver1.65 and earlier
North Grid Proself Mail Sanitize Edition Ver1.08 and earlier

Timeline

2023-10-18: disclosed: NVD Published Date
2024-12-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
2024-12-24: other: CISA KEV remediation due date

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.