CVE-2023-23327 Information disclosure in n/a
Attackers can access sensitive fax and database backups stored on the web server without authentication due to predictable filenames and missing access controls.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-23327?
CVE-2023-23327 is a medium-severity vulnerability in n/a, published on 10 Mar 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An Information Disclosure vulnerability exists in AvantFAX 3.3.7. Backups of the AvantFAX sent/received faxes, and database backups are stored using the current date as the filename and hosted on the web server without access controls.
Weakness: CWE-200
Which versions are affected by CVE-2023-23327?
It affects 1 product.
Products include Avantfax Avantfax.
How do I fix CVE-2023-23327?
No fix has been published for CVE-2023-23327 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-23327 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-23327 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-485r-459v-j5pq.