CVE-2023-48382: medium-severity vulnerability in Softnext Mail SQR Expert
Softnext Mail SQR Expert - Local File Inclusion-2
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.6%
Softnext Mail SQR Expert is an email management platform, it has a Local File Inclusion (LFI) vulnerability in a mail deliver-related URL. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify partial system information but does not affect service availability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Softnext · Mail SQR ExpertRelated CVEs — Softnext Mail SQR Expert
In the same product, most dangerous first.
CVE-2023-48378HIGHSoftnext Mail SQR Expert - Path Traversal EPSS 1.3%CVE-2023-48380HIGHSoftnext Mail SQR Expert - Command InjectionEPSS 0.7%CVE-2023-48381MEDIUMSoftnext Mail SQR Expert - Local File Inclusion-1EPSS 0.6%CVE-2023-48379MEDIUMSoftnext Mail SQR Expert - Blind Server-Side Request Forgey (SSRF)EPSS 0.6%