Vulnerability · Published Mar 18, 2024 · Assigned by jpcert
CVE-2023-40747
High 7.5
In plain English
A high-severity path traversal in pmman.exe (Enterprise edition) from A.K.I Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.3%top 29.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Directory traversal vulnerability exists in A.K.I Software's PMailServer/PMailServer2 products' CGIs included in Internal Simple Webserver. If this vulnerability is exploited, a remote attacker may access arbitrary files outside DocumentRoot.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| A.K.I Software | pmman.exe (Standard edition) | 2.5.1.12154 and earlier |
| A.K.I Software | pmman.exe (Pro edition) | 2.5.1.12155 and earlier |
| A.K.I Software | pmman.exe (Standard + IMAP4 edition) | 2.5.1.12156 and earlier |
| A.K.I Software | pmman.exe (Pro + IMAP4 edition) | 2.5.1.12157 and earlier |
| A.K.I Software | pmman.exe (Enterprise edition) | 2.5.1.12158 and earlier |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N