CVE-2023-48380

Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function. A remote attacker authenticated as a localhost can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service.

CVSS v3 8.0 HIGH

8.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.twcert.org.tw/tw/cp-132-7598-37b03-1.html	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:softnext:mail_sqr_expert:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-12-15 09:15

Updated : 2023-12-21 15:58

NVD link : CVE-2023-48380

Mitre link : CVE-2023-48380

CVE.ORG link : CVE-2023-48380

JSON object : View

Products Affected

softnext

mail_sqr_expert

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2023-48380", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}, {"type": "Secondary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.5}]}, "published": "2023-12-15T09:15:07.577", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7598-37b03-1.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}, {"type": "Secondary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function. A remote attacker authenticated as a localhost can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service."}, {"lang": "es", "value": "Softnext Mail SQR Expert es una plataforma de gesti\u00f3n de correo electr\u00f3nico, no tiene filtrado suficiente para un car\u00e1cter especial dentro de una funci\u00f3n espec\u00edfica. Un atacante remoto autenticado como host local puede aprovechar esta vulnerabilidad para realizar ataques de inyecci\u00f3n de comandos, ejecutar comandos arbitrarios del sistema, manipular el sistema o interrumpir el servicio."}], "lastModified": "2023-12-21T15:58:54.407", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:softnext:mail_sqr_expert:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "30D54AFA-951B-44FD-84F6-0C16F338E2CE", "versionEndExcluding": "230330"}], "operator": "OR"}]}], "sourceIdentifier": "twcert@cert.org.tw"}