CVE-2023-28152

CRITICO 9.8CVE-2023-28152 · Published 24/03/2023 · updated 17/06/2026

In breve

CVE-2023-28152 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda jword (independentsoft).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.75%, superiore al 55.0% delle vulnerabilità.
Correzione: aggiornare a 1.1.110 o successiva.

Package	Affected versions	Patched versions
jword independentsoft	`< 1.1.110`	`1.1.110`

Description

An issue was discovered in Independentsoft JWord before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file.

References

cds.thalesgroup.com/en/tcs-cert/CVE-2023-28152
excellium-services.com/cert-xlm-advisory/CVE-2023-28152 · Third Party Advisory
independentsoft.de/jword/index.html · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free