CVE-2023-48382
Last modified
CVE-2023-48382 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a mail deliver-related URL. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify partial system information but does not affect service availability.. EPSS estimates a 0.62% chance of exploitation in the next 30 days.
Description
Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a mail deliver-related URL. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify partial system information but does not affect service availability.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Softnext | Mail Sqr Expert | < 230330 |
References
- https://www.twcert.org.tw/tw/cp-132-7600-dd072-1.htmlThird Party Advisory
- https://www.twcert.org.tw/tw/cp-132-7600-dd072-1.htmlThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-48382?
How severe is CVE-2023-48382?
How do I fix CVE-2023-48382?
Are you affected by CVE-2023-48382?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST