CVE-2020-28387

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3). When opening a specially crafted SEECTCXML file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external dtd. (ZDI-CAN-11923)

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

VendorProductVersions
SiemensSolid Edge SE2020All Versions < SE2020MP13
SiemensSolid Edge SE2021All Versions < SE2021MP3

References

Timeline

Published
Mar 15, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-283885.3A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions <CVE-2020-28398.2Vulnerability in the Oracle Service Intelligence product of Oracle E-Business Suite (component: Internal Operations- Search). Supported versCVE-2020-283905.5A vulnerability has been identified in Opcenter Execution Core (V8.2), Opcenter Execution Core (V8.3). The application contains an informatiCVE-2020-283915.9A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT sCVE-2020-283927.8A vulnerability has been identified in SIMARIS configuration (All versions < V4.0.1). During installation to default target folder, incorrecCVE-2020-283937.5An unauthenticated remote attacker could create a permanent denial-of-service condition by sending specially crafted OSPF packets. SuccessfuCVE-2020-283945.5A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected appliCVE-2020-283955.9A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 andCVE-2020-283967.3A vulnerability has been identified in SICAM A8000 CP-8000 (All versions < V16), SICAM A8000 CP-8021 (All versions < V16), SICAM A8000 CP-80CVE-2020-283975.3A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP CVE-2020-283988.8A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGECVE-2020-28408.2Vulnerability in the Oracle E-Business Intelligence product of Oracle E-Business Suite (component: DBI Setups). Supported versions that are
CVE-2020-28387: Medium severity, CVSS 5.5 | Vulnix