What is CVE-2023-37290?

CVE-2023-37290 is a high-severity vulnerability in Infodoc Document On-Line Submission And Approval System, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.5/10. Published 2023-07-20.

How severe is CVE-2023-37290?

High severity. CVSS v3 base score is 7.5 out of 10.

SSRF in Infodoc Document On-Line Submission And Approval System

CVE-2023-37290

InfoDoc Document On-line Submission and Approval System lacks sufficient restrictions on the available tags within its HTML to PDF conversion function, and allowing an unauthenticated attackers to load remote or local resources through HTML tags such as iframe. This vulnerability allows unauthenticated remote attackers to perform Server-Side Request Forgery (SSRF) attacks, gaining unauthorized access to arbitrary system files and uncovering the internal network topology.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.007 (50.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Infodoc Document On-line Submission And Approval System — versions 22547, 22567
Infodoc Document_on-line_submission_and_approval_system — versions 22547, 22567

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

twcert@cert.org.tw (Third Party Advisory)

Frequently asked questions

What is CVE-2023-37290?: CVE-2023-37290 is a high-severity vulnerability in Infodoc Document On-Line Submission And Approval System, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.5/10. Published 2023-07-20.
How severe is CVE-2023-37290?: High severity. CVSS v3 base score is 7.5 out of 10.