High severity · published Jul 20, 2023
CVE-2023-37290
InfoDoc Document On-line Submission and Approval System - Server-Side Request Forgery (SSRF)
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
InfoDoc Document On-line Submission and Approval System lacks sufficient restrictions on the available tags within its HTML to PDF conversion function, and allowing an unauthenticated attackers to load remote or local resources through HTML tags such as iframe. This vulnerability allows unauthenticated remote attackers to perform Server-Side Request Forgery (SSRF) attacks, gaining unauthorized access to arbitrary system files and uncovering the internal network topology.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Document On-line Submission and Approval System · InfoDoc
22547; 22567 · source: vendor, NVD
Affected product
DO
Document On-line Submission and Approval System
InfoDoc
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-37290
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-37290
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-7226-12195-1.html
More from Document On-line Submission and Approval System
9.8
CVE-2023-37289
InfoDoc Document On-line Submission and Approval System - Arbitrary File Upload