CVE-2023-2806mediumobserved exploitationCWE-611

CVE-2023-2806: medium-severity vulnerability in Weaver e-cology

Weaver e-cology API RequestInfoByXml xml external entity reference

Published · Updated

Follow this CVE+ Monitor e-cology

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

35Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Attendcvss 5.5epss 1.0%
from disclosure to weapon
Published on NVDMay 19
VulnCheck+984d
A vulnerability classified as problematic was found in Weaver e-cology up to 9.0. Affected by this vulnerability is the function RequestInfoByXml of the component API. The manipulation leads to xml external entity reference. The associated identifier of this vulnerability is VDB-229411. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
Weaver · e-cology
Related CVEs — Weaver e-cology

In the same product, most dangerous first.

CVE-2024-7704MEDIUMWeaver e-cology Source Code ecology_dev.zip information disclosureEPSS 0.8%CVE-2023-3793MEDIUMWeaver e-cology HTTP POST Request filelFileDownloadForOutDoc.class sql injectionEPSS 0.5%