1 min read

Mitigation Instructions for CVE-2023-3823

Mitigation Instructions for CVE-2023-3823

SUBJECT: Mitigating CVE-2023-3823: PHP XML External Entity (XXE) Vulnerability


DATE(S) ISSUED: 08/11/2023

NVD Last Modified: 10/27/2023



This document outlines the steps to mitigate the vulnerability (CVE-2023-3823) in PHP, which affects versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8. This vulnerability allows attackers to exploit improper handling of external entities in XML processing, potentially leading to information disclosure.


  1. Upgrade PHP: The recommended solution is to upgrade to a version of PHP that includes the fix for this vulnerability. This includes:
    • PHP 8.0.30 (or later)
    • PHP 8.1.22 (or later)
    • PHP 8.2.8 (or later)
  • Disable external entity loading (if necessary): If upgrading PHP is not immediately possible, you can temporarily disable external entity loading in your PHP applications. However, this is a stop-gap solution and should not be considered a long-term mitigation strategy due to potential side effects on functionalities. Consult your application documentation for specific instructions on disabling external entity loading.
  • Sanitize user-supplied XML data: If you must continue processing untrusted XML data, thoroughly sanitize it before parsing to prevent the inclusion of malicious entities. This can be achieved using libraries or functions specifically designed for XML sanitization.

Additional mitigation steps:

  • Review logs: Monitor system logs for any suspicious activity, particularly involving the processing of XML data.
  • Implement network segmentation: Segment your network to limit the potential impact of a successful exploit.
  • Implement least privilege: Apply the principle of least privilege to user accounts and processes to minimize potential damage if an attacker gains access.

Confirmation & Additional Information:

    • Verify that the mitigation steps have been successfully implemented.
    • Keep your PHP installation up-to-date with the latest security patches.
  • Refer to the following resources for additional information:

This document is provided for informational purposes only and should not be considered a substitute for professional security advice.

Mitigation Instructions for Adobe ColdFusion CVE-2023-29300

Mitigation Instructions for Adobe ColdFusion CVE-2023-29300

SUBJECT: CVE-2023-29300: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability - Detailed Mitigation Guide

Read More
Mitigation Instructions for Microsoft Exchange Server CVE-2024-21410

Mitigation Instructions for Microsoft Exchange Server CVE-2024-21410

SUBJECT: Critical Exchange Server Elevation of Privilege Vulnerability (CVE-2024-21410)

Read More
Mitigation Instructions for Cisco ASA and FTD CVE-2020-3259

Mitigation Instructions for Cisco ASA and FTD CVE-2020-3259

SUBJECT: Mitigate Cisco ASA and FTD Information Disclosure Vulnerability (CVE-2020-3259)

Read More