CVE-2023-39481mediumCWE-436

CVE-2023-39481: medium-severity vulnerability in Softing Secure Integration Server

Softing Secure Integration Server Interpretation Conflict Remote Code Execution Vulnerability

Published · Updated

Follow this CVE+ Monitor Secure Integration Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.6epss 1.6%
Softing Secure Integration Server Interpretation Conflict Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing Secure Integration Server. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the web server. The issue results from an inconsistency in URI parsing between NGINX and application code. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20551.
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Softing · Secure Integration Server
Related CVEs — Softing Secure Integration Server

In the same product, most dangerous first.

CVE-2022-1373HIGHSofting Secure Integration Server Relative Path TraversalEPSS 13.2%CVE-2022-2334HIGHSofting Secure Integration Server Uncontrolled Search Path ElementEPSS 12.1%CVE-2022-1069HIGHSofting Secure Integration Server Out-of-bounds ReadEPSS 1.6%CVE-2022-2335HIGHSofting Secure Integration Server Integer UnderflowEPSS 1.6%CVE-2022-2337HIGHSofting Secure Integration Server NULL Pointer DereferenceEPSS 1.6%CVE-2022-2547HIGHSofting Secure Integration Server NULL Pointer DereferenceEPSS 1.6%