CVE-2023-45192 is a high severity XML external entity flaw in IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3, scored 8.2. IBM says to install iFix 29 or newer on 7.0.2 and iFix 1 or newer on 7.0.3. There is no workaround.
What's affected
IBM bulletin node 7156492, first published on 5 June 2024, lists IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 as affected. The NVD record was published on 2024-06-06.
NVD scores the flaw 8.2 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L and IBM publishes 8.2 on the bulletin, so the sources agree. IBM tracks the issue as X-Force ID 268758.
IBM says the fix is delivered as interim fixes: ifix 29 or newer for version 7.0.2, and ifix 1 or newer for version 7.0.3. The bulletin lists no workarounds or mitigations.
The flaw is in the processing of XML data. A remote attacker with no privileges could use it to expose sensitive information or consume memory resources.
Weakness class: CWE-611 (XML external entity reference).
How to check if you're exposed
Read the DOORS Next version and interim fix level from the server. In the IBM Engineering Lifecycle Management tools, the administration pages show the installed version and applied fixes. On the server, the installed interim fixes are also recorded in the product installation records.
Compare your level with the bulletin: 7.0.2 needs ifix 29 or newer, and 7.0.3 needs ifix 1 or newer. Also check which network segments can reach the DOORS Next URL, since the flaw needs no login.
What to do now
- Find all DOORS Next servers and note version and interim fix for each.
- Apply ifix 29 or newer on 7.0.2, or ifix 1 or newer on 7.0.3, following the IBM bulletin.
- Because IBM lists no workaround, plan the maintenance window rather than waiting.
- Limit access to the application to the networks and users that need it while you prepare the update.
- Review server memory alerts and logs from before the update for unusual spikes.
Why it matters
XML external entity injection, tracked as CWE-611, happens when an XML parser is allowed to resolve references to outside files or URLs. IBM says the result here can be disclosure of sensitive information or memory exhaustion, which matches the C:H and A:L ratings in the score.
DOORS Next stores requirements, which can include design details, regulatory content and customer specifications. A flaw that needs no login and exposes data from the server deserves a place near the top of a patching queue. CVE-2023-45192 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay.
The demo below shows how to check whether a fix is available for a component you run, which here is yes, with a clear version for each branch.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which interim fixes address CVE-2023-45192?
ifix 29 or newer for 7.0.2, and ifix 1 or newer for 7.0.3, per the IBM bulletin.
Is there a workaround?
No. The IBM bulletin lists none, so install the fix.
Sources
- Gold entry for CVE-2023-45192
- IBM security bulletin
- IBM X-Force entry 268758 (page did not render when fetched)
Last reviewed: 19 October 2026.
