XXE in Enterprise Architect XSLT Debugger
Sparx Systems Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger. A user who loads a crafted XML file whose DOCTYPE references an external DTD causes the parser to resolve external entities. An attacker can then read arbitrary files from the victim’s filesystem; confidentiality impact is high and there is no integrity or availability impact in the CVSS vector. The issue is confirmed only in version 17.1 because the vendor could not be reached, and other versions may also be affected. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Do not open untrusted XML in Enterprise Architect’s XSLT Debugger, especially files that declare a DOCTYPE or external DTD. Treat 17.1 as confirmed vulnerable and other versions as potentially affected until the vendor publishes a fix; restrict local file access for users who must use the feature and watch for unexpected outbound entity fetches.
| Product | Affected |
|---|---|
| Sparx Systems Enterprise Architect | 17.1 confirmed; other versions may also be affected |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 17.1 but may also affect other versions.
Unpatched ZDI zero-day lets remote attackers leak data from Sparx Enterprise Architect via XXE with user interaction.
Today 563 readers · 641 views · 208 reads · all time 187K views