Lucene search

GitHub_MCVE-2023-41034

HistoryAug 31, 2023 - 6:15 p.m.

CVE-2023-41034

2023-08-3118:15:09

CWE-611

GitHub_M

web.nvd.nist.gov

cve-2023-41034

eclipse leshan

xxe attacks

ddffileparser

defaultddffilevalidator

objectloader

lwm2m

device management

java

vulnerability

upgrade

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.001

Percentile

35.0%

JSON

Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParserandDefaultDDFFileValidator(and soObjectLoader) are vulnerable to XXE Attacks`. A DDF file is a LWM2M format used to store LWM2M object description. Leshan users are impacted only if they parse untrusted DDF files (e.g. if they let external users provide their own model), in that case they MUST upgrade to fixed version. If you parse only trusted DDF file and validate only with trusted xml schema, upgrading is not mandatory. This issue has been fixed in versions 1.5.0 and 2.0.0-M13. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected configurations

Nvd

Vulners

Node

eclipseleshanRange<1.5.0

eclipseleshanMatch2.0.0milestone1

eclipseleshanMatch2.0.0milestone10

eclipseleshanMatch2.0.0milestone11

eclipseleshanMatch2.0.0milestone12

eclipseleshanMatch2.0.0milestone2

eclipseleshanMatch2.0.0milestone3

eclipseleshanMatch2.0.0milestone4

eclipseleshanMatch2.0.0milestone5

eclipseleshanMatch2.0.0milestone6

eclipseleshanMatch2.0.0milestone7

eclipseleshanMatch2.0.0milestone8

eclipseleshanMatch2.0.0milestone9

VendorProductVersionCPE
eclipseleshan*cpe:2.3:a:eclipse:leshan:*:*:*:*:*:*:*:*
eclipseleshan2.0.0cpe:2.3:a:eclipse:leshan:2.0.0:milestone1:*:*:*:*:*:*
eclipseleshan2.0.0cpe:2.3:a:eclipse:leshan:2.0.0:milestone10:*:*:*:*:*:*
eclipseleshan2.0.0cpe:2.3:a:eclipse:leshan:2.0.0:milestone11:*:*:*:*:*:*
eclipseleshan2.0.0cpe:2.3:a:eclipse:leshan:2.0.0:milestone12:*:*:*:*:*:*
eclipseleshan2.0.0cpe:2.3:a:eclipse:leshan:2.0.0:milestone2:*:*:*:*:*:*
eclipseleshan2.0.0cpe:2.3:a:eclipse:leshan:2.0.0:milestone3:*:*:*:*:*:*
eclipseleshan2.0.0cpe:2.3:a:eclipse:leshan:2.0.0:milestone4:*:*:*:*:*:*
eclipseleshan2.0.0cpe:2.3:a:eclipse:leshan:2.0.0:milestone5:*:*:*:*:*:*
eclipseleshan2.0.0cpe:2.3:a:eclipse:leshan:2.0.0:milestone6:*:*:*:*:*:*

Vendor	Product	Version	CPE
eclipse	leshan	*	cpe:2.3:a:eclipse:leshan::::::::
eclipse	leshan	2.0.0	cpe:2.3:a:eclipse:leshan:2.0.0:milestone1::::::
eclipse	leshan	2.0.0	cpe:2.3:a:eclipse:leshan:2.0.0:milestone10::::::
eclipse	leshan	2.0.0	cpe:2.3:a:eclipse:leshan:2.0.0:milestone11::::::
eclipse	leshan	2.0.0	cpe:2.3:a:eclipse:leshan:2.0.0:milestone12::::::
eclipse	leshan	2.0.0	cpe:2.3:a:eclipse:leshan:2.0.0:milestone2::::::
eclipse	leshan	2.0.0	cpe:2.3:a:eclipse:leshan:2.0.0:milestone3::::::
eclipse	leshan	2.0.0	cpe:2.3:a:eclipse:leshan:2.0.0:milestone4::::::
eclipse	leshan	2.0.0	cpe:2.3:a:eclipse:leshan:2.0.0:milestone5::::::
eclipse	leshan	2.0.0	cpe:2.3:a:eclipse:leshan:2.0.0:milestone6::::::

Rows per page:

1-10 of 131

CNA Affected

[
  {
    "vendor": "eclipse-leshan",
    "product": "leshan",
    "versions": [
      {
        "version": "< 1.5.0",
        "status": "affected"
      },
      {
        "version": ">= 2.0.0-M1, < 2.0.0-M13",
        "status": "affected"
      }
    ]
  }
]