Medium · 6.3 CVE-2023-49234 EUVD-2023-53237GHSA-3x6c-xfwc-qp7m

An XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8. It allows an authenticated attacker to access local serve…

Published Mar 29, 2024 · Updated Mar 27, 2025 · Assigned by mitre

Description

An XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8. It allows an authenticated attacker to access local server files and exfiltrate data to an external server.

References

https://www.visual-planning.com/en/support-portal/updates
https://www.schutzwerk.com/blog/schutzwerk-sa-2023-006/
https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2023-006.txt
20240405 SCHUTZWERK-SA-2023-006: Arbitrary File Read via XML External Entities in Visual Planning mailing-list