CVE-2023-32635

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

XBRL data create application version 7.0 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XBRL file, arbitrary files on the system may be read by an attacker.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

VendorProductVersions
Financial Services AgencyXBRL data create applicationversion 7.0 and earlier

References

Timeline

Published
Jul 19, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-326367.5A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validaCVE-2023-326379.8GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests. Therefore, anyoCVE-2023-326387.8Incorrect default permissions in some Intel Arc RGB Controller software before version 1.06 may allow an authenticated user to potentially eCVE-2023-326395.5Applicant Programme Ver.7.06 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML fiCVE-2023-32649.8The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internalCVE-2023-326418.8Improper input validation in firmware for Intel(R) QAT before version QAT20.L.1.0.40-00004 may allow escalation of privilege and denial of sCVE-2023-326426.5Insufficient adherence to expected conventions for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.24CVE-2023-326437.8A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665CVE-2023-326446.5Protection mechanism failure for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unaCVE-2023-326459.8A leftover debug code vulnerability exists in the httpd debug credentials functionality of Yifan YF325 v1.0_20221108. A specially crafted neCVE-2023-326467.3Uncontrolled search path element in some Intel(R) VROC software before version 8.0.8.1001 may allow an authenticated user to potentially enaCVE-2023-326477.8Improper access control in some Intel(R) XTU software before version 7.12.0.29 may allow an authenticated user to potentially enable escalat
CVE-2023-32635: Medium severity, CVSS 5.5 | Vulnix