High severity · published Aug 3, 2023
CVE-2023-37497
The Unica application exposes an API which accepts arbitrary XML input
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks (XXE) against the backend service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UN
Unica · Hcltech
before 11.1.0.6; 12.0 before 12.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-37497
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-37497
Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106547
More from Unica
9.8
CVE-2025-62319
Boolean-Based SQL Injection in Multiple Unica Components
8.8
CVE-2023-37498
A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator
7.5
CVE-2025-51735
CSV formula injection vulnerability in HCL Technologies Ltd
7.5
CVE-2025-31996
Unprotected files are impacting HCL Unica Platform
7.5
CVE-2025-52616
HCL Unica 12.1.10 is affected by an exposure of sensitive information