CVE-2023-45727

Proself, a self-hosted groupware/webmail product line from Japan's North Grid, improperly restricts XML external entity references (CWE-611) when processing XML data submitted to the server. A remote, unauthenticated attacker can send a specially crafted request containing malformed XML that triggers XXE resolution, allowing the attacker to read arbitrary files on the server, including files containing account information. Successful exploitation therefore primarily threatens confidentiality — exposed account credentials and sensitive data on the server — with no impact on integrity or availability per the CVSS 3.1 vector (7.5, AV:N/AC:L/PR:N/UI:N). Organizations running Proself Enterprise/Standard Edition 5.62 or earlier, Gateway Edition 1.65 or earlier, or Mail Sanitize Edition 1.08 or earlier are affected. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2024-12-03, confirming exploitation in the wild, and EPSS estimates a 3.5% probability of exploitation in the next 30 days (89th percentile); no public PoC is known.

What to do: Upgrade all Proself editions to fixed releases per North Grid's guidance — beyond Ver5.62 for Enterprise/Standard, beyond Ver1.65 for Gateway, and beyond Ver1.08 for Mail Sanitize — or discontinue use of the product if mitigations are unavailable, per CISA's required action. Prioritize internet-facing Proself instances, review web/application logs for suspicious XML-containing requests, and rotate exposed account credentials since account information files are the primary target of this file-read flaw.