Unsafe XML parsing of 3rd party DICOM private tags may lead to XXE

CVE-2023-3892

What is CVE-2023-3892?

An improper restriction in the XML External Entity Reference vulnerability within MIM Assistant and Client's DICOM RTst loading modules allows attackers to exploit XML Entity Linking. By crafting a malicious XML document and embedding it into private RTst metadata tags, an attacker can transfer a compromised DICOM object to MIM, leading to arbitrary data manipulation upon loading. Users are advised to update to versions 7.2.11 or 7.3.4 and above to mitigate this issue. As of now, there are no known exploits in the wild related to this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References