What’s Vulnerable › Vulnerabilities

CVE-2023-40747

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-18 · updated 2026-06-17
• Weakness: CWE-22

Description

Directory traversal vulnerability exists in A.K.I Software's PMailServer/PMailServer2 products' CGIs included in Internal Simple Webserver. If this vulnerability is exploited, a remote attacker may access arbitrary files outside DocumentRoot.

Affected products

• Aki Pmman.Exe/Enterprise Edition/: before 2.5.1.12158 — fixed in 2.5.1.12158
• Aki Pmman.Exe/Pro Edition/: before 2.5.1.12155 — fixed in 2.5.1.12155
• Aki Pmman.Exe/Pro Plus Imap4 Edition/: before 2.5.1.12157 — fixed in 2.5.1.12157
• Aki Pmman.Exe/Standard Edition/: before 2.5.1.12154 — fixed in 2.5.1.12154
• Aki Pmman.Exe/Standard Plus Imap4 Edition: before 2.5.1.12156 — fixed in 2.5.1.12156

How to fix

Upgrade to a fixed version: Aki Pmman.Exe/Enterprise Edition/ 2.5.1.12158; Aki Pmman.Exe/Pro Edition/ 2.5.1.12155; Aki Pmman.Exe/Pro Plus Imap4 Edition/ 2.5.1.12157; Aki Pmman.Exe/Standard Edition/ 2.5.1.12154; Aki Pmman.Exe/Standard Plus Imap4 Edition 2.5.1.12156. Check the vendor advisory for mitigations.

References

• https://akisoftware.com/Vulnerability202301.html
• https://jvn.jp/en/jp/JVN92720882/
• https://akisoftware.com/Vulnerability202301.html
• https://jvn.jp/en/jp/JVN92720882/

Get alerted when CVE-2023-40747 or the next vulnerability affects your stack