CVE Catalog
CVE-2023-37364
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk0.54%
41th percentile - higher than 41% of all known CVEs
Summary
In WS-Inc J WBEM Server version 4.7.4 before 4.7.5, the CIM-XML protocol adapter does not disable entity resolution. This allows context-dependent attackers to read arbitrary files or cause a denial of service.
Risk Assessment
The organization may be exposed to unauthorized data access or service interruptions, which can lead to serious operational consequences.
Recommendation
It is recommended to update the WS-Inc J WBEM Server to version 4.7.5 or later to mitigate this vulnerability.
Original NVD description (English source)
In WS-Inc J WBEM Server 4.7.4 before 4.7.5, the CIM-XML protocol adapter does not disable entity resolution. This allows context-dependent attackers to read arbitrary files or cause a denial of service, a similar issue to CVE-2013-4152.