Vulnerability · Published Dec 15, 2023 · Assigned by twcert
CVE-2023-48379Softnext Mail SQR Expert - Blind Server-Side Request Forgey (SSRF)
Medium 5.3
In plain English
A medium-severity server-side request forgery in Mail SQR Expert from Softnext. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.6%top 51.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Softnext | Mail SQR Expert | – through 230330 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N