High severity8.1NVD Advisory· Published Aug 3, 2023· Updated Jun 17, 2026

CVE-2023-37497

Description

The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks (XXE) against the backend service.

Affected products

HCLTech/Unica Plan
cpe:2.3:a:hcltech:unica:*:*:*:*:*:*:*:*
Range: <11.1.0.6
HCL Software/Unicallm-create
HCL Software/Unica Platformcpe-rescue
Range: < 11.1.0.6, <12.1.1

Patches

Vulnerability mechanics

References

support.hcltechsw.com/csmnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000