CVE-2023-34209

Published Oct 17, 2023

Last updated a year ago

CVSS medium 4.3

Overview

Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere in create template function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to obtain the absolute path via unencrypted VIEWSTATE parameter.
Source: ART@zuso.ai
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.3
Impact score: 1.4
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: NVD-CWE-Other
ART@zuso.ai: CWE-497

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:easyuse:mailhunter_ultimate:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "94D027C5-7AB4-4652-A7E8-4F979194ED01",
            "versionEndIncluding": "2023"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References