{"id":"CVE-2023-4595","state":"PUBLISHED","title":"Insertion of Sensitive Information into Externally-Accessible File or Directory in BVRP Software SLmail","description":"An information exposure vulnerability has been found, the exploitation of which could allow a remote user to retrieve sensitive information stored on the server such as credential files, configuration files, application files, etc., simply by appending any of the following parameters to the end of the URL: %00 %0a, %20, %2a, %a0, %aa, %c0 and %ca.","publishedAt":"2023-11-23T12:38:04.999Z","updatedAt":"2024-08-02T07:31:06.614Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"INCIBE"},"assigner":"INCIBE","products":["BVRP Software SLmail"],"affected":[{"vendor":"BVRP Software","product":"SLmail","defaultStatus":"unaffected","versions":[{"version":"5.5.0.4433","status":"affected"}]}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bvrp-software-slmail"],"weaknesses":["CWE-538"],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/4xxx/CVE-2023-4595.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-4595","state":"PUBLISHED","datePublished":"2023-11-23T12:38:04.999Z","dateUpdated":"2024-08-02T07:31:06.614Z","assignerShortName":"INCIBE","assignerOrgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateReserved":"2023-08-29T08:30:24.615Z"},"containers":{"cna":{"title":"Insertion of Sensitive Information into Externally-Accessible File or Directory in BVRP Software SLmail","descriptions":[{"lang":"en","value":"An information exposure vulnerability has been found, the exploitation of which could allow a remote user to retrieve sensitive information stored on the server such as credential files, configuration files, application files, etc., simply by appending any of the following parameters to the end of the URL: %00 %0a, %20, %2a, %a0, %aa, %c0 and %ca."}],"affected":[{"vendor":"BVRP Software","product":"SLmail","defaultStatus":"unaffected","versions":[{"version":"5.5.0.4433","status":"affected"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bvrp-software-slmail"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-538","description":"CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"INCIBE","orgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateUpdated":"2023-11-23T12:38:04.999Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Rafael Pedrero"}],"datePublic":"2023-11-23T11:00:00.000Z","impacts":[{"capecId":"CAPEC-95","descriptions":[{"lang":"en","value":"CAPEC-95 WSDL Scanning"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"There is no reported solution at the moment."}],"value":"There is no reported solution at the moment."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bvrp-software-slmail","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T07:31:06.614Z"}}]}}}