ID:9733 - Exploit for XML External Entity injection in ClamAV - CVE-2023-20052

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to enabling XML entity substitution. A remote attacker can pass a specially crafted XML code to the antivirus and view bytes from any file that may be read by the ClamAV scanning process.

Remediation