CVE-2023-4593 Path Traversal in BVRP Software SLmail
An authenticated remote attacker can bypass SecurityManager restrictions to list parent directories via path traversal in SLmail.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4593?
CVE-2023-4593 is a medium-severity path traversal vulnerability in BVRP Software SLmail, published on 23 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Path traversal vulnerability whose exploitation could allow an authenticated remote user to bypass SecurityManager's intended restrictions and list a parent directory via any filename, such as a multiple ..%2F value affecting the 'dodoc' parameter in the /MailAdmin_dll.htm file.
Weakness: CWE-22
Which versions are affected by CVE-2023-4593?
It affects 1 product.
Products include Seattlelab Slmail.
How do I fix CVE-2023-4593?
No fix has been published for CVE-2023-4593 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-4593 being exploited?
There is no known exploitation of CVE-2023-4593 in the wild and no public exploit code.
Other vulnerabilities in BVRP Software SLmail
Sources
Also known as GHSA-8835-pqf9-c9cq.