CVE-2023-24187
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code by uploading a crafted XML file to /ureport/designer/saveReportFile.
Risk Assessment
An attacker can remotely execute arbitrary code on the server, leading to full system compromise, data theft, or further attacks on the infrastructure.
Recommendation
Immediately update ureport to the latest version that fixes the XXE vulnerability, and restrict access to the /ureport/designer/saveReportFile endpoint to trusted users only.
Other vulnerabilities in ureport
See all- CVE-2026-38158Critical
A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to inject malicious SQL queries. This flaw enables unauthorized access to sensitive database information.
- CVE-2023-24188Critical
A directory traversal vulnerability was discovered in ureport version 2.2.9 within the deletion function, allowing arbitrary file deletion.
Original NVD description (English source)
An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.