{"cve":"CVE-2023-49110","nvd":{"published":"2024-06-20T13:15:49.250","modified":"2026-06-17T06:35:23.580","status":"Deferred","description":"When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web \napplication (either on-premises or cloud/SaaS solution), the transmitted data \nconsists of a ZIP archive containing several files, some of them in the \nXML file format. During Kiuwan's server-side processing of these XML \nfiles, it resolves external XML entities, resulting in a XML external \nentity injection attack. An attacker with privileges to scan \nsource code within the \"Code Security\" module is able to extract any \nfiles of the operating system with the rights of the application server \nuser and is potentially able to gain sensitive files, such as \nconfiguration and passwords. Furthermore, this vulnerability also allows\n an attacker to initiate connections to internal systems, e.g. for port \nscans or accessing other internal functions / applications such as the \nWildfly admin console of Kiuwan.\n\nThis issue affects Kiuwan SAST: <master.1808.p685.q13371","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2},"cwes":["CWE-611"],"references":["https://r.sec-consult.com/kiuwan","https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log","http://seclists.org/fulldisclosure/2024/Jun/3","https://r.sec-consult.com/kiuwan","https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:52:00.836172422+00:00"},"epss":{"cve":"CVE-2023-49110","score":0.0082,"percentile":0.57291,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}