CVE-2023-45612

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published
Oct 9, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-456139.1In JetBrains Ktor before 2.3.5 server certificates were not verifiedCVE-2023-456149.8There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending CVE-2023-456159.8There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending CVE-2023-456169.8There is a buffer overflow vulnerability in the underlying AirWave client service that could lead to unauthenticated remote code execution bCVE-2023-456178.2There are arbitrary file deletion vulnerabilities in the CLI service accessed by PAPI (Aruba's access point management protocol). SuccessfulCVE-2023-456188.2There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI (Aruba's access point management protocol).CVE-2023-456198.2There is an arbitrary file deletion vulnerability in the RSSI service accessed by PAPI (Aruba's access point management protocol). SuccessfuCVE-2023-45629.1Improper Authentication vulnerability in Mitsubishi Electric Corporation MELSEC-F Series main modules allows a remote unauthenticated attackCVE-2023-456207.5Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of CVE-2023-456217.5Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of CVE-2023-456227.5Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol. Successful exploitatCVE-2023-456237.5Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Wi-Fi Uplink service accessed via the PAPI protocol. Successful exploit
CVE-2023-45612: Critical severity, CVSS 9.8 | Vulnix