North Grid Proself XXE Vulnerability (CVE-2023-45727)

Historical catalog analysis: CISA added this entry on December 03, 2024. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2023-45727 is an improper restriction of XML External Entity (XXE) reference vulnerability (CWE-611) identified in North Grid Proself products. This flaw allows a remote, unauthenticated attacker to conduct an XXE attack against affected systems.

Exposure and applicability

This vulnerability affects the following North Grid Proself product lines:
* Proself Enterprise
* Proself Standard
* Proself Gateway
* Proself Mail Sanitize

Exposure is high for organizations deploying these products in network-accessible positions, as the attack vector does not require prior authentication to execute.

Remediation priorities

Based on our analysis of the vulnerability’s nature and vendor requirements, defenders should prioritize the following actions:

1. Asset Identification: Immediately audit the environment to identify all instances of Proself Enterprise, Standard, Gateway, and Mail Sanitize.
2. Vendor Mitigation Application: Apply the specific mitigations provided by North Grid. Because XXE vulnerabilities often stem from insecure XML parser configurations, following vendor-specific guidance is necessary to ensure the parser is hardened against external entity resolution.
3. Decommissioning Evaluation: In scenarios where vendor mitigations are unavailable or cannot be applied due to legacy constraints, the product should be discontinued to eliminate the exposure path.

How to validate remediation

Verification must go beyond a simple version check, as software versions do not always guarantee that specific configuration-based mitigations have been successfully deployed.

To verify that exposure has been reduced, vulnerability management teams should seek evidence that the XML parser no longer processes external entities. This can be achieved through authorized security testing or by reviewing system configuration files against the vendor’s hardening checklist to confirm that external entity resolution is explicitly disabled. A successful validation result is one where an attempt to reference an external entity fails to trigger a request to an external resource.

Limits and open questions

While the vulnerability is documented, it remains unknown whether this flaw has been utilized in known ransomware campaigns. Additionally, the source does not specify the exact version ranges affected; defenders must rely on North Grid’s direct documentation to determine if their specific build is vulnerable.

Residual risk remains if compensating controls (such as Web Application Firewalls) are used instead of the vendor’s root-cause mitigation, as WAF signatures may be bypassed by obfuscated XML payloads.

Source and editorial note

CVE-2023-45727: North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability · Source date: December 03, 2024 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: December 06, 2024. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: November 02, 2026 at 00:08 UTC.

Request a Vulnerability Assessment