CVE-2023-37290

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-37290
InfoDoc Document On-line Submission and Approval System lacks sufficient restrictions on the available tags within its HTML to PDF conversion function, and allowing an unauthenticated attackers to load remote or local resources through HTML tags such as iframe. This vulnerability allows unauthenticated remote attackers to perform Server-Side Request Forgery (SSRF) attacks, gaining unauthorized access to arbitrary system files and uncovering the internal network topology.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.twcert.org.tw/tw/cp-132-7226-12195-1.html Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-7226-12195-1.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:infodoc:document_on-line_submission_and_approval_system:22547:*:*:*:*:*:*:*
cpe:2.3:a:infodoc:document_on-line_submission_and_approval_system:22567:*:*:*:*:*:*:*
History

21 Nov 2024, 08:11

Type Values Removed Values Added
References () https://www.twcert.org.tw/tw/cp-132-7226-12195-1.html - Third Party Advisory () https://www.twcert.org.tw/tw/cp-132-7226-12195-1.html - Third Party Advisory

28 Jul 2023, 15:39

Type Values Removed Values Added
CPE cpe:2.3:a:infodoc:document_on-line_submission_and_approval_system:22567:*:*:*:*:*:*:*
cpe:2.3:a:infodoc:document_on-line_submission_and_approval_system:22547:*:*:*:*:*:*:*
First Time Infodoc
Infodoc document On-line Submission And Approval System
References (MISC) https://www.twcert.org.tw/tw/cp-132-7226-12195-1.html - (MISC) https://www.twcert.org.tw/tw/cp-132-7226-12195-1.html - Third Party Advisory

21 Jul 2023, 03:15

Type Values Removed Values Added
Summary InfoDoc Document On-line Submission and Approval System lacks sufficient restrictions on the available tags within its HTML to PDF conversion function, and allowing an unauthenticated attackers to load remote or local resources through HTML tags such as iframe. This vulnerability allows unauthenticated remote attackers to perform Server-Side Request Forgery (SSRF) attacks, gaining unauthorized access to arbitrary system files and uncovering the internal network topology. InfoDoc Document On-line Submission and Approval System lacks sufficient restrictions on the available tags within its HTML to PDF conversion function, and allowing an unauthenticated attackers to load remote or local resources through HTML tags such as iframe. This vulnerability allows unauthenticated remote attackers to perform Server-Side Request Forgery (SSRF) attacks, gaining unauthorized access to arbitrary system files and uncovering the internal network topology.

20 Jul 2023, 11:19

Type Values Removed Values Added
New CVE
Information

Published : 2023-07-20 11:15

Updated : 2024-11-21 08:11

NVD link : CVE-2023-37290

Mitre link : CVE-2023-37290

CVE.ORG link : CVE-2023-37290

JSON object : View

Products Affected

infodoc

  • document_on-line_submission_and_approval_system
CWE
CWE-918

Server-Side Request Forgery (SSRF)