What is CVE-2020-28387?

CVE-2020-28387 is a medium-severity vulnerability in Siemens Solid Edge, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 5.5/10. Published 2021-03-15.

How severe is CVE-2020-28387?

Medium severity. CVSS v3 base score is 5.5 out of 10.

XXE in Siemens Solid Edge

CVE-2020-28387

A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3). When opening a specially crafted SEECTCXML file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external dtd. (ZDI-CAN-11923)

Vulnerability class: XXE (XML External Entity)

EPSS: 0.009 (55.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

Affected products

Siemens Solid_edge — versions se2021
Siemens Solid Edge Se2020 — versions All Versions < SE2020MP13
Siemens Solid Edge Se2021 — versions All Versions < SE2021MP3

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

productcert@siemens.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-28387?: CVE-2020-28387 is a medium-severity vulnerability in Siemens Solid Edge, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 5.5/10. Published 2021-03-15.
How severe is CVE-2020-28387?: Medium severity. CVSS v3 base score is 5.5 out of 10.