SSRF Exploit Through SMTP Configuration Options
CVE-2023-45705

7.2HIGH

Key Information:

Vendor
Hcl Software
Status
Bigfix Platform
Vendor
CVE Published:
28 March 2024

Summary

An administrative user of HCL WebReports can exploit a Server Side Request Forgery (SSRF) vulnerability through specific SMTP configuration options. This issue can lead to unauthorized access and manipulation, posing significant risks to system integrity and data security. Organizations using HCL WebReports should assess their configurations and implement necessary precautions to mitigate potential exploitation.

Affected Version(s)

BigFix Platform 10.0 - 10.0.10, 11.0.0 - 11.0.1

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_a...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.