Read the docs
TI-2023-24508 Aliases CVE-2023-45727GHSA-m745-jcvj-8cx6

XML external entity injection in North Grid Proself Enterprise/Standard Edition

Priority CRITICAL 90Exploited in the wildCWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-611 and the CVSS impact.

Summary

Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.

Why it matters now

Exploitation Active In CISA KEV since 2024-12-03CISA due date 2024-12-24
EPSS 0.04822 92nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
North GridProself Enterprise/Standard EditionVer5.62 and earlier—No fix listedCNA
North GridProself Gateway EditionVer1.65 and earlier—No fix listedCNA
North GridProself Mail Sanitize EditionVer1.08 and earlier—No fix listedCNA
  • Proself Enterprise/Standard Edition VendorNorth Grid Affected Ver5.62 and earlier Fixed in — No fix listed CNA
  • Proself Gateway Edition VendorNorth Grid Affected Ver1.65 and earlier Fixed in — No fix listed CNA
  • Proself Mail Sanitize Edition VendorNorth Grid Affected Ver1.08 and earlier Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:northgrid:proself:*:*:*:*:mail_sanitize:*:*:*before 1.09VulnerableNorth Grid
cpe:2.3:a:northgrid:proself:*:*:*:*:gateway:*:*:*before 1.66VulnerableNorth Grid
cpe:2.3:a:northgrid:proself:*:*:*:*:enterprise:*:*:*before 5.63VulnerableNorth Grid
cpe:2.3:a:northgrid:proself:*:*:*:*:standard:*:*:*before 5.63VulnerableNorth Grid
  • cpe:2.3:a:northgrid:proself:*:*:*:*:mail_sanitize:*:*:* Versions before 1.09 Vulnerable ·North Grid
  • cpe:2.3:a:northgrid:proself:*:*:*:*:gateway:*:*:* Versions before 1.66 Vulnerable ·North Grid
  • cpe:2.3:a:northgrid:proself:*:*:*:*:enterprise:*:*:* Versions before 5.63 Vulnerable ·North Grid
  • cpe:2.3:a:northgrid:proself:*:*:*:*:standard:*:*:* Versions before 5.63 Vulnerable ·North Grid

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2024-12-03 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2023-45727
  3. 2026-10-03 Alias added: GHSA-m745-jcvj-8cx6
  4. 2026-10-19 EPSS moved to the 90th–95th percentile

References

Advisory 2

  • TI-2023-20554 Improper authentication in North Grid Proself Enterprise/Standard Edition CVSS 3.1HIGH 7.5
  • TI-2023-20555 OS command injection in North Grid Proself Enterprise/Standard Edition CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences