CVE-2023-20052

MEDIUM

ClamAV <1.0.0 - Info Disclosure

Title source: llm

Description

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process.

Exploits (3)

nomisec WORKING POC 27 stars
by nokn0wthing · poc
https://github.com/nokn0wthing/CVE-2023-20052
nomisec WORKING POC
by MOHITSINGHPAPOLA · poc
https://github.com/MOHITSINGHPAPOLA/CVE-2023-20052
nomisec WORKING POC
by cY83rR0H1t · poc
https://github.com/cY83rR0H1t/CVE-2023-20052

References (1)

Scores

CVSS v3 5.3
EPSS 0.0633
EPSS Percentile 90.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Classification

CWE
CWE-611 CWE-776
Status published

Affected Products (9)

cisco/secure_endpoint < 1.20.2
cisco/secure_endpoint < 1.21.1
cisco/secure_endpoint < 7.5.9
cisco/secure_endpoint_private_cloud < 3.6.0
clamav/clamav < 0.103.7
clamav/clamav
clamav/clamav
clamav/clamav
stormshield/stormshield_network_security < 3.7.35

Timeline

Published Mar 01, 2023
Tracked Since Feb 18, 2026