CVE-2023-22278 Auth bypass in m-FILTER Ver.5 Series and Ver.4 Series
Remote attackers can bypass authentication to send unintended emails under specific conditions, affecting m-FILTER email security gateways.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-22278?
CVE-2023-22278 is a medium-severity authentication bypass vulnerability in Digital Arts Inc. m-FILTER Ver.5 Series and Ver.4 Series, published on 17 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
m-FILTER prior to Ver.5.70R01 (Ver.5 Series) and m-FILTER prior to Ver.4.87R04 (Ver.4 Series) allows a remote unauthenticated attacker to bypass authentication and send users' unintended email when email is being sent under the certain conditions. The attacks exploiting this vulnerability have been observed.
Weakness: CWE-287
Which versions are affected by CVE-2023-22278?
It affects 1 product.
Products include Daj M-Filter.
How do I fix CVE-2023-22278?
No fix has been published for CVE-2023-22278 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-22278 being exploited?
There is no known exploitation of CVE-2023-22278 in the wild and no public exploit code.
Sources
Also known as GHSA-722g-wg5c-74m2.