CVE-2023-48380

Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function. A remote attacker authenticated as a localhost can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.5 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.twcert.org.tw/tw/cp-132-7598-37b03-1.html	Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-7598-37b03-1.html	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:softnext:mail_sqr_expert:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:31

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~8.0~~	v2 : unknown v3 : 7.4
References	~~() https://www.twcert.org.tw/tw/cp-132-7598-37b03-1.html - Third Party Advisory~~	() https://www.twcert.org.tw/tw/cp-132-7598-37b03-1.html - Third Party Advisory

21 Dec 2023, 15:58

Type	Values Removed	Values Added
References	~~() https://www.twcert.org.tw/tw/cp-132-7598-37b03-1.html -~~	() https://www.twcert.org.tw/tw/cp-132-7598-37b03-1.html - Third Party Advisory
CWE		CWE-78
CVSS	v2 : ~~unknown~~ v3 : ~~7.4~~	v2 : unknown v3 : 8.0
CPE		cpe:2.3:a:softnext:mail_sqr_expert::::::::
First Time		Softnext Softnext mail Sqr Expert

15 Dec 2023, 13:42

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-12-15 09:15

Updated : 2024-11-21 08:31

NVD link : CVE-2023-48380

Mitre link : CVE-2023-48380

CVE.ORG link : CVE-2023-48380

JSON object : View

Products Affected

softnext

mail_sqr_expert

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2023-48380", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}]}, "published": "2023-12-15T09:15:07.577", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7598-37b03-1.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}, {"url": "https://www.twcert.org.tw/tw/cp-132-7598-37b03-1.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-78"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function. A remote attacker authenticated as a localhost can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service."}, {"lang": "es", "value": "Softnext Mail SQR Expert es una plataforma de gesti\u00f3n de correo electr\u00f3nico, no tiene filtrado suficiente para un car\u00e1cter especial dentro de una funci\u00f3n espec\u00edfica. Un atacante remoto autenticado como host local puede aprovechar esta vulnerabilidad para realizar ataques de inyecci\u00f3n de comandos, ejecutar comandos arbitrarios del sistema, manipular el sistema o interrumpir el servicio."}], "lastModified": "2024-11-21T08:31:36.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:softnext:mail_sqr_expert:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "30D54AFA-951B-44FD-84F6-0C16F338E2CE", "versionEndExcluding": "230330"}], "operator": "OR"}]}], "sourceIdentifier": "twcert@cert.org.tw"}