CVE-2023-4595 - Insertion of Sensitive Information into Externally-Accessible File or Directory in BVRP Software SLmail

Back Back to CVE browser

HIGH

Insertion of Sensitive Information into Externally-Accessible File or Directory in BVRP Software SLmail

Published Nov 23, 2023

7.5

HIGH

CVSS 3.1

EPSS 0.72%

Description

An information exposure vulnerability has been found, the exploitation of which could allow a remote user to retrieve sensitive information stored on the server such as credential files, configuration files, application files, etc., simply by appending any of the following parameters to the end of the URL: %00 %0a, %20, %2a, %a0, %aa, %c0 and %ca.

Affected products

Vendor BVRP Software Product SLmail Default
unaffected
- Version
  5.5.0.4433
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

BVRP Software

SLmail

unaffected

Version	Status	Constraints
5.5.0.4433	affected	-

Remediation

Vendor solution

There is no reported solution at the moment.

Weaknesses (1)

CWE-538

References (1)

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bvrp-software-slmail
Third Party Advisory

Link	Providers	Tags
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bvrp-software-slmail		Third Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner INCIBE

Published Nov 23, 2023

Updated Aug 2, 2024

Reserved Aug 29, 2023

Link CVE-2023-4595

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-4595

Red Hat

Severity n/a

Public date n/a

Links CVE-2023-4595