What’s Vulnerable › Vulnerabilities

CVE-2023-4595: Insertion of Sensitive Information into Externally-Accessible File or Directory in BVRP Software SLmail

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-23 · updated 2026-06-17
• Weakness: CWE-538

Description

An information exposure vulnerability has been found, the exploitation of which could allow a remote user to retrieve sensitive information stored on the server such as credential files, configuration files, application files, etc., simply by appending any of the following parameters to the end of the URL: %00 %0a, %20, %2a, %a0, %aa, %c0 and %ca.

Affected products

• BVRP Software SLmail: 5.5.0.4433

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bvrp-software-slmail
• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bvrp-software-slmail

Get alerted when CVE-2023-4595 or the next vulnerability affects your stack