CVE-2023-41034

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser` and `DefaultDDFFileValidator` (and so `ObjectLoader`) are vulnerable to `XXE Attacks`. A DDF file is a LWM2M format used to store LWM2M object description. Leshan users are impacted only if they parse untrusted DDF files (e.g. if they let external users provide their own model), in that case they MUST upgrade to fixed version. If you parse only trusted DDF file and validate only with trusted xml schema, upgrading is not mandatory. This issue has been fixed in versions 1.5.0 and 2.0.0-M13. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published: Aug 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-410367.8Macvim is a text editor for MacOS. Prior to version 178, Macvim makes use of an insecure interprocess communication (IPC) mechanism which co CVE-2023-410374.3OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographica CVE-2023-410387.5Firebird is a relational database. Versions 4.0.0 through 4.0.3 and version 5.0 beta1 are vulnerable to a server crash when a user uses a sp CVE-2023-410397.7RestrictedPython is a restricted execution environment for Python to run untrusted code. Python's "format" functionality allows someone cont CVE-2023-41045.5An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitra CVE-2023-410406.5GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from th CVE-2023-410413.1Graylog is a free and open log management platform. In a multi-node Graylog cluster, after a user has explicitly logged out, a user session CVE-2023-410426.5Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `te CVE-2023-410436.5Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `te CVE-2023-410443.8Graylog is a free and open log management platform. A partial path traversal vulnerability exists in Graylog's `Support Bundle` feature. The CVE-2023-410455.3Graylog is a free and open log management platform. Graylog makes use of only one single source port for DNS queries. Graylog binds a single CVE-2023-410466.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute