XML External Entity Injection in Nokia NetAct Software

CVE-2023-26058

Summary

An XML External Entity Injection (XXE) vulnerability has been identified in Nokia's NetAct software prior to version 22 FP2211. This issue arises from inadequate input validation and misconfiguration of the XML parser used in the Performance Manager page. While the complexity of the attack limits its practicality to internal users, it remains a concern as it may allow an attacker with access to internal systems to craft malicious XML documents that could exploit this weakness, leading to potential exposure of sensitive data.

References