7.4

CVE-2023-3892

Improper Restriction of XML External Entity Reference vulnerability in MIM Assistant and Client DICOM RTst Loading modules allows XML Entity Linking / XML External Entities Blowup.




In order to take advantage of this vulnerability, an attacker must 
craft a malicious XML document, embed this document into specific 3rd 
party private RTst metadata tags, transfer the now compromised 
DICOM object to MIM, and force MIM to archive and load the data.

Users on either version are strongly encouraged to update to an unaffected version (7.2.11+, 7.3.4+).

This issue was found and analyzed by MIM Software's internal security team.  We are unaware of any proof of concept or actual exploit available in the wild.


For more information, visit  https://www.mimsoftware.com/cve-2023-3892 https://www.mimsoftware.com/cve-2023-3892 




This issue affects MIM Assistant: 7.2.10, 7.3.3; MIM Client: 7.2.10, 7.3.3.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mimsoftware ≫ Assistant Version7.2.10
Mimsoftware ≫ Assistant Version7.3.3
Mimsoftware ≫ Client Version7.2.10
Mimsoftware ≫ Client Version7.3.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.11% 0.304
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.4 1.5 5.9
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
security@mimsoftware.com 5.6 0.9 4.7
CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H
CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.