CVE-2023-39472: 
NixOS vulnerability analysis and mitigation

CVE-2023-39472 is a vulnerability in Inductive Automation Ignition's SimpleXMLReader class that was discovered in 2023. The vulnerability allows remote attackers to disclose sensitive information on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability (Zero Day Initiative).

The vulnerability exists within the SimpleXMLReader class. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. The vulnerability has been assigned a CVSS v3.0 base score of 6.5 (Medium) with the vector string: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (Zero Day Initiative).

An attacker can leverage this vulnerability to disclose sensitive information in the context of the SYSTEM. The vulnerability affects the confidentiality of the system but does not impact integrity or availability (Zero Day Initiative).

The vulnerability requires authentication to exploit. A remote attacker with valid credentials can exploit this vulnerability by sending a specially crafted XML document to the affected system (Zero Day Initiative).

Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the application. The vendor was notified of the vulnerability on June 1, 2022, and acknowledged the report on June 2, 2022. As of August 8, 2023, when the zero-day advisory was published, no patch was available (Zero Day Initiative).