CVE-2023-22377

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-02-15 · updated 2026-06-17
Weakness: CWE-611

Description

Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClinical Metadata Desktop Tools Version 1.0.3 to Version 1.1.0. If this vulnerability is exploited, an attacker may obtain an arbitrary file which meets a certain condition by reading a specially crafted XML file.

Affected products

Fujitsu Tsclinical Define.Xml Generator: from 1.0.0 through 1.4.0
Fujitsu Tsclinical Metadata Desktop Tools: from 1.0.3 before 1.1.1 — fixed in 1.1.1

How to fix

Upgrade to a fixed version: Fujitsu Tsclinical Metadata Desktop Tools 1.1.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-22377 or the next vulnerability affects your stack