CVE-2023-45727VulnerabilityPublished 18 Oct 2023Updated 21 Oct 2025

CVE-2023-45727: North Grid Proself Enterprise/Standard Edition · XML external entities (XXE)

Affects North Grid Proself Enterprise/Standard EditionSource CVE Database V5

Exploited in the wild · KEV due 24 Dec 2024 · 4% EPSS : apply the vendor's fix or mitigations to North Grid Proself Enterprise/Standard Edition now.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

7.5High

How severe the flaw is on the 0–10 CVSS scale.

KEV deadline: 24 Dec 2024 US federal agencies must patch by this date; a sensible deadline for everyone else.
EPSS: 4.8% chance of exploitation in 30 days – higher than 91% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 18 Oct 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 1.1 years after disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE ID reserved
by jpcert
2023-10-1107:32Z, 7 days before disclosure
CVE published
on cve.org
2023-10-1809:01Z, t = 0
Added to CISA KEV (opens in a new tab)
exploitation confirmed
2024-12-03, 1.1 years after disclosure
KEV remediation due
US federal deadline
2024-12-24, 1.2 years after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected software

Product	Affected	Fixed in
North Grid Corporation Proself Enterprise/Standard Edition	Affected <=5.62	Fixed in–

Description

Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.

Impact

For European organizations, exploitation of CVE-2023-45727 could lead to unauthorized disclosure of sensitive internal files, including account information, configuration files, or other critical data stored on servers running affected Proself software. This data leakage can facilitate further attacks such as privilege escalation, lateral movement, or targeted phishing campaigns. The confidentiality breach may also result in non-compliance with GDPR and other data protection regulations, exposing organizations to legal and financial penalties. Given that Proself products are used in enterprise file sharing and mail sanitization, disruption or compromise could impact business continuity and trust. The remote, unauthenticated nature of the vulnerability increases the risk of widespread exploitation, especially in environments exposed to the internet. European organizations with limited patch management capabilities or those unaware of this vulnerability are particularly vulnerable. Additionally, the exposure of account information could lead to identity theft or unauthorized access to other connected systems, amplifying the impact.

Mitigation

1. Monitor North Grid Corporation’s official channels for patches addressing CVE-2023-45727 and apply them promptly once released. 2. Temporarily disable XML external entity processing in the Proself applications’ XML parsers if configuration options allow, to prevent XXE exploitation. 3. Implement strict input validation and sanitization on all XML inputs to reject malformed or suspicious XML content. 4. Restrict network access to Proself services, limiting exposure to trusted internal networks or VPNs to reduce attack surface. 5. Conduct thorough audits of server file permissions to minimize sensitive data exposure in case of exploitation. 6. Deploy web application firewalls (WAFs) with rules to detect and block XXE attack patterns targeting XML inputs. 7. Increase monitoring and logging of XML processing errors and unusual file access attempts to detect potential exploitation attempts early. 8. Educate IT and security teams about the vulnerability specifics to ensure rapid response and containment. 9. Review and update incident response plans to include scenarios involving XXE attacks and data exfiltration. 10. Consider network segmentation to isolate critical systems running Proself products from less secure environments.

CWE-611Improper Restriction of XML External Entity Reference (opens in a new tab)
Base weaknessOWASP Top 10 A02:2025: Security Misconfiguration (opens in a new tab)
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Implementation · System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
OWASP Cheat Sheets
Deserialization (opens in a new tab)
XML Security (opens in a new tab)
XML External Entity Prevention (opens in a new tab)
OWASP ASVS 4.0.3
V5.5.2 (opens in a new tab)
Attack patterns
Data Serialization External Entities Blowup (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Affected software

Description

AI analysisMachine-generated, updated 21 Oct 2025, 20:05 UTC

WeaknessesCWE-611

Technical details

References

Community reviews

Related threats