CVE-2023-28008: high-severity vulnerability in HCL Software Workload Automation
HCL Workload Automation is vulnerable to XML External Entity (XXE) Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
HCL Workload Automation improperly processes XML files, allowing attackers to read sensitive data or crash the system by injecting malicious XML code. This happens because the software doesn't safely handle external entities in XML documents.
XXE injection vulnerability in HCL Workload Automation 9.4, 9.5, and 10.1 allows remote attackers to exploit unsafe XML parsing. Attack vectors include XML entity expansion (billion laughs) for denial of service and external entity references for information disclosure; no authentication is required. Impact includes unauthorized access to sensitive files and system resource exhaustion.
In the same product, most dangerous first.