infodoc の document on-line submission and approval system におけるサーバサイドのリクエストフォージェリの脆弱性
| Title |
infodoc の document on-line submission and approval system におけるサーバサイドのリクエストフォージェリの脆弱性
|
| Summary |
infodoc の document on-line submission and approval system には、サーバサイドのリクエストフォージェリの脆弱性が存在します。
|
| Possible impacts |
情報を取得される可能性があります。 |
| Solution |
参考情報を参照して適切な対策を実施してください。 |
| Publication Date |
July 20, 2023, midnight |
| Registration Date |
Jan. 26, 2024, 11:49 a.m. |
| Last Update |
Jan. 26, 2024, 11:49 a.m. |
|
CVSS3.0 : 重要
|
| Score |
7.5
|
| Vector |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected System
| infodoc |
|
document on-line submission and approval system 22547
|
|
document on-line submission and approval system 22567
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
その他
Change Log
| No |
Changed Details |
Date of change |
| 1 |
[2024年01月26日]
掲載 |
Jan. 26, 2024, 11:49 a.m. |
NVD Vulnerability Information
CVE-2023-37290
| Summary |
InfoDoc Document On-line Submission and Approval System lacks sufficient restrictions on the available tags within its HTML to PDF conversion function, and allowing an unauthenticated attackers to load remote or local resources through HTML tags such as iframe. This vulnerability allows unauthenticated remote attackers to perform Server-Side Request Forgery (SSRF) attacks, gaining unauthorized access to arbitrary system files and uncovering the internal network topology.
|
| Publication Date |
July 20, 2023, 8:15 p.m. |
| Registration Date |
July 21, 2023, 10 a.m. |
| Last Update |
Nov. 21, 2024, 5:11 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:infodoc:document_on-line_submission_and_approval_system:22567:*:*:*:*:*:*:* |
|
|
|
|
| cpe:2.3:a:infodoc:document_on-line_submission_and_approval_system:22547:*:*:*:*:*:*:* |
|
|
|
|
Related information, measures and tools
Common Vulnerabilities List