Security readout for executives and security teams
Plain-English summary
This flaw affects Fujitsu tsClinical tools used around Define.xml and metadata workflows. A crafted XML file could let an attacker obtain certain files the tool can access. The business risk is exposure of sensitive clinical, operational, or system data if affected versions process untrusted XML.
Executive priority
Treat as high priority where tsClinical tools handle external XML or sensitive clinical data. Prioritize inventory, exposure reduction, and vendor-guided remediation over emergency response absent exploitation evidence.
Technical view
CVE-2023-22377 is a CWE-611 XML External Entity issue in tsClinical Define.xml Generator v1.0.0-v1.4.0 and tsClinical Metadata Desktop Tools v1.0.3-v1.1.0. The CVSS 3.1 score is 7.4, with high confidentiality and integrity impact, high attack complexity, and no availability impact.
Likely exposure
Exposure is likely limited to organizations using the listed tsClinical products and versions, especially where XML files originate from partners, submissions, shared drives, or other untrusted sources.
Exploitation context
The provided sources do not show CISA KEV listing or confirmed active exploitation. They state exploitation requires reading a specially crafted XML file and may obtain an arbitrary file meeting certain conditions.
Researcher notes
The source bundle leaves remediation specifics and the exact file-access condition unclear. Validate exposure by product/version and XML ingestion paths, but do not assume broader Fujitsu product impact beyond the named tsClinical tools.
Mitigation direction
- Inventory affected tsClinical installations and versions.
- Check JVN and tsClinical GitHub advisories for vendor remediation guidance.
- Avoid processing XML files from untrusted or unverified sources.
- Limit tool access to sensitive local and network files.
- Apply vendor updates or mitigations when confirmed by the vendor.
Validation and detection
- Identify systems running affected tsClinical product versions.
- Review workflows that import or open external XML files.
- Confirm whether vendor advisories list fixed versions or workarounds.
- Check endpoint and file-access logs for unusual reads during XML processing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-611: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-22377 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N2.25.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.4HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/tsClinical/tsc-desktop/security/advisoriesCVE reference
- https://jvn.jp/en/jp/JVN00712821/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.