An XML External Entity injection vulnerability in Datavane TIS version 5 allows authenticated attackers to potentially expose sensitive system data.

The application fails to properly restrict XML External Entity references (CWE-611), allowing an authenticated user to perform unauthorized actions or access local files.

With a CVSS score of 7.7, this vulnerability presents a high risk of data exfiltration. An attacker can leverage the XXE flaw to read sensitive files from the server, potentially compromising internal configuration data or credentials, which could lead to further escalation.

Immediate Action: Review vendor documentation for the latest release addressing the doEditWorkflow endpoint vulnerability.

Proactive Monitoring: Audit application logs for XML-based requests containing unexpected external entity references or attempts to access local system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block malicious XML inputs that utilize external DTDs or entities.

Public Exploit Available: No (no confirmed weaponized exploit or public PoC identified).

While a specific patch version is not explicitly listed, users must contact the vendor or monitor the repository for the release containing the provided fix commit. Restricting access to the workflow functionality until a patch is applied is highly recommended.