Medium severity · published Nov 1, 2023
CVE-2023-5515
The responses for web queries with certain parameters disclose internal path of resources
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
The responses for web queries with certain parameters disclose internal path of resources. This information can be used to learn internal structure of the application and to further plot attacks against
web servers and deployed web applications.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
eSOMS · Hitachi Energy
6.0 through 6.3.13 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-5515
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-5515
Vendor Advisory
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000175&languageCode=en&Preview=true
More from eSOMS
5.3
CVE-2023-5516
Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underlying technology and…
5.3
CVE-2023-5514
The response messages received from the eSOMS report generation using certain parameter queries with full file path can be abused for enumerating the local file system structure