Vulnerability · Published Nov 23, 2023 · Assigned by INCIBE
CVE-2023-4593Path Traversal in BVRP Software SLmail
Medium 6.5
In plain English
A medium-severity path traversal in SLmail from BVRP Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.1%top 34.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Path traversal vulnerability whose exploitation could allow an authenticated remote user to bypass SecurityManager's intended restrictions and list a parent directory via any filename, such as a multiple ..%2F value affecting the 'dodoc' parameter in the /MailAdmin_dll.htm file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BVRP Software | SLmail | 5.5.0.4433 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N