CVE-2023-20052 [Medium] | Information Disclosure in Secure Endpoint

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-06	4.94%	3.55%	-1.39%
2	2026-06-01	3.96%	4.94%	+0.98%
3	2026-05-24	—	3.96%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-06

4.94%

3.55%

-1.39%

2026-06-01

3.96%

4.94%

+0.98%

2026-05-24

—

3.96%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.3	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:N) Service keeps running; no real outage angle.	3.9	1.4	[email protected]
5.3	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:N) Service keeps running; no real outage angle.	3.9	1.4	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

5.3

3.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L): Some sensitive info could get out, but not a total data dump.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:N): Service keeps running; no real outage angle.

3.9

1.4

[email protected]

5.3

3.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L): Some sensitive info could get out, but not a total data dump.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:N): Service keeps running; no real outage angle.

3.9

1.4

[email protected]

OS Trackers for CVE-2023-20052

vendor	priority	summary	link
`alpine`	—	CVE-2023-20052: 1 source package rows (clamav); 7 state rows across 7 repos (3.17-community, 3.18-community, 3.19-community, 3.20-community, 3.21-community, 3.22-community, edge-community); fixed 7, open 0.	https://security.alpinelinux.org/vuln/CVE-2023-20052
`debian`	not yet assigned	CVE-2023-20052 not yet assigned priority: Debian including 1 source packages (clamav), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2023-20052
`gentoo`	normal	CVE-2023-20052: 1 GLSA(s) (202310-01), 1 atom(s) (app-antivirus/clamav); latest impact normal.	https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2023-20052
`suse`	medium	CVE-2023-20052 severity moderate: SUSE including 32 source package names (clamav-0.103.11-150600.16.7, clamav-0.103.8-0.20.53.1, …), 122 product×package rows across 38 product lines (Image SLES12-SP5-SAP-Azure-LI-BYOS-Production, Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production, … (38 product lines)): Fixed 122.	https://www.suse.com/security/cve/CVE-2023-20052/
`ubuntu`	medium	CVE-2023-20052 medium priority: Ubuntu including 1 source packages (clamav), 8 status rows across 8 suites (bionic, focal, jammy, kinetic, lunar, trusty, upstream, xenial): released 7, needs-triage 1.	https://ubuntu.com/security/CVE-2023-20052

Affected software / configurations for CVE-2023-20052

Vendor	Product	Version	Raw CPE
cisco	secure_endpoint	< 1.20.2	cpe:2.3:a:cisco:secure_endpoint::::::linux::*
cisco	secure_endpoint	< 1.21.1	cpe:2.3:a:cisco:secure_endpoint::::::macos::*
cisco	secure_endpoint	< 7.5.9	cpe:2.3:a:cisco:secure_endpoint::::::windows::*
cisco	secure_endpoint	>= 8.0.1.21160, < 8.1.5	cpe:2.3:a:cisco:secure_endpoint::::::windows::*
cisco	secure_endpoint_private_cloud	< 3.6.0	cpe:2.3:a:cisco:secure_endpoint_private_cloud::::::::
clamav	clamav	<= 0.103.7	cpe:2.3:a:clamav:clamav::::::::
clamav	clamav	>= 0.104.0, <= 0.105.1	cpe:2.3:a:clamav:clamav::::::::
clamav	clamav	1.0.0	cpe:2.3:a:clamav:clamav:1.0.0:-::::::
clamav	clamav	1.0.0	cpe:2.3:a:clamav:clamav:1.0.0:rc::::::
clamav	clamav	1.0.0	cpe:2.3:a:clamav:clamav:1.0.0:rc2::::::
stormshield	stormshield_network_security	>= 3.0.0, < 3.7.35	cpe:2.3:a:stormshield:stormshield_network_security::::::::
stormshield	stormshield_network_security	>= 3.8.0, < 3.11.23	cpe:2.3:a:stormshield:stormshield_network_security::::::::
stormshield	stormshield_network_security	>= 4.3.0, < 4.3.17	cpe:2.3:a:stormshield:stormshield_network_security::::::::
stormshield	stormshield_network_security	>= 4.4.0, < 4.6.4	cpe:2.3:a:stormshield:stormshield_network_security::::::::

References for CVE-2023-20052

URL	Tags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-xxe-TcSZduhN	Vendor Advisory

URL

CVE-2023-20052

Exploit prediction scoring system (EPSS) score for CVE-2023-20052

Common vulnerability scoring system (CVSS) metrics for CVE-2023-20052

Weakness enumeration for CVE-2023-20052

OS Trackers for CVE-2023-20052

Affected software / configurations for CVE-2023-20052

References for CVE-2023-20052