When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of confidentiality.
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Connected_components_workbench | Rockwellautomation | * | 12.0 (including) |
| Isagraf | Rockwellautomation | * | 6.6.9 (including) |
| Safety_instrumented_systems_workstation | Rockwellautomation | * | 1.1 (including) |