CVE-2023-39415 - Vulnerability Details - OpenCVE

Improper authentication vulnerability in Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlier, and Proself Mail Sanitize Edition Ver1.07 and earlier allow a remote unauthenticated attacker to log in to the product's Control Panel and perform an unintended operation.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00338.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Northgrid	Proself Proself Enterprise Standard Edition Proself Gateway Edition Proself Mail Sanitize Edition

Configuration 1 [-]

OR	cpe:2.3:a:northgrid:proself:::::mail_sanitize:::*
	cpe:2.3:a:northgrid:proself:::::gateway:::*
	cpe:2.3:a:northgrid:proself:::::enterprise:::*
	cpe:2.3:a:northgrid:proself:::::standard:::*

No data.

No data.

References

Link	Providers
https://jvn.jp/en/jp/JVN19661362/
https://www.proself.jp/information/149/
https://www.proself.jp/information/150/

History

Tue, 08 Oct 2024 17:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Northgrid proself Enterprise Standard Edition Northgrid proself Gateway Edition Northgrid proself Mail Sanitize Edition
CPEs		cpe:2.3:a:northgrid:proself_enterprise_standard_edition:::::::: cpe:2.3:a:northgrid:proself_gateway_edition:::::::: cpe:2.3:a:northgrid:proself_mail_sanitize_edition::::::::
Vendors & Products		Northgrid proself Enterprise Standard Edition Northgrid proself Gateway Edition Northgrid proself Mail Sanitize Edition
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2023-08-18T09:26:24.246Z

Updated: 2024-10-08T16:16:41.532Z

Reserved: 2023-08-01T01:06:32.262Z

Link: CVE-2023-39415

Vulnrichment

Updated: 2024-08-02T18:10:20.423Z

NVD

Status : Modified

Published: 2023-08-18T10:15:11.620

Modified: 2024-11-21T08:15:22.563

Link: CVE-2023-39415

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-39415", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2023-08-01T01:06:32.262Z", "datePublished": "2023-08-18T09:26:24.246Z", "dateUpdated": "2024-10-08T16:16:41.532Z"}, "containers": {"cna": {"affected": [{"vendor": "North Grid Corporation", "product": "Proself Enterprise/Standard Edition", "versions": [{"version": "Ver5.61 and earlier", "status": "affected"}]}, {"vendor": "North Grid Corporation", "product": "Proself Gateway Edition", "versions": [{"version": "Ver1.62 and earlier", "status": "affected"}]}, {"vendor": "North Grid Corporation", "product": "Proself Mail Sanitize Edition", "versions": [{"version": "Ver1.07 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Improper authentication vulnerability in Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlier, and Proself Mail Sanitize Edition Ver1.07 and earlier allow a remote unauthenticated attacker to log in to the product's Control Panel and perform an unintended operation."}], "problemTypes": [{"descriptions": [{"description": "Improper authentication", "lang": "en", "type": "text"}]}], "references": [{"url": "https://www.proself.jp/information/149/"}, {"url": "https://www.proself.jp/information/150/"}, {"url": "https://jvn.jp/en/jp/JVN19661362/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2023-08-18T09:26:24.246Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:10:20.423Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.proself.jp/information/149/", "tags": ["x_transferred"]}, {"url": "https://www.proself.jp/information/150/", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN19661362/", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "northgrid", "product": "proself_enterprise_standard_edition", "cpes": ["cpe:2.3:a:northgrid:proself_enterprise_standard_edition:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "5.61", "versionType": "custom"}]}, {"vendor": "northgrid", "product": "proself_gateway_edition", "cpes": ["cpe:2.3:a:northgrid:proself_gateway_edition:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.62", "versionType": "custom"}]}, {"vendor": "northgrid", "product": "proself_mail_sanitize_edition", "cpes": ["cpe:2.3:a:northgrid:proself_mail_sanitize_edition:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.07", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-08T16:13:41.089575Z", "id": "CVE-2023-39415", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-08T16:16:41.532Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-39415", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2023-08-01T01:06:32.262Z", "datePublished": "2023-08-18T09:26:24.246Z", "dateUpdated": "2024-10-08T16:16:41.532Z"}, "containers": {"cna": {"affected": [{"vendor": "North Grid Corporation", "product": "Proself Enterprise/Standard Edition", "versions": [{"version": "Ver5.61 and earlier", "status": "affected"}]}, {"vendor": "North Grid Corporation", "product": "Proself Gateway Edition", "versions": [{"version": "Ver1.62 and earlier", "status": "affected"}]}, {"vendor": "North Grid Corporation", "product": "Proself Mail Sanitize Edition", "versions": [{"version": "Ver1.07 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Improper authentication vulnerability in Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlier, and Proself Mail Sanitize Edition Ver1.07 and earlier allow a remote unauthenticated attacker to log in to the product's Control Panel and perform an unintended operation."}], "problemTypes": [{"descriptions": [{"description": "Improper authentication", "lang": "en", "type": "text"}]}], "references": [{"url": "https://www.proself.jp/information/149/"}, {"url": "https://www.proself.jp/information/150/"}, {"url": "https://jvn.jp/en/jp/JVN19661362/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2023-08-18T09:26:24.246Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:10:20.423Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.proself.jp/information/149/", "tags": ["x_transferred"]}, {"url": "https://www.proself.jp/information/150/", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN19661362/", "tags": ["x_transferred"]}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-39415", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-08T16:13:41.089575Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:northgrid:proself_enterprise_standard_edition:*:*:*:*:*:*:*:*"], "vendor": "northgrid", "product": "proself_enterprise_standard_edition", "versions": [{"status": "affected", "version": "0", "lessThan": "5.61", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:northgrid:proself_gateway_edition:*:*:*:*:*:*:*:*"], "vendor": "northgrid", "product": "proself_gateway_edition", "versions": [{"status": "affected", "version": "0", "lessThan": "1.62", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:northgrid:proself_mail_sanitize_edition:*:*:*:*:*:*:*:*"], "vendor": "northgrid", "product": "proself_mail_sanitize_edition", "versions": [{"status": "affected", "version": "0", "lessThan": "1.07", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-08T16:16:36.436Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:northgrid:proself:*:*:*:*:mail_sanitize:*:*:*", "matchCriteriaId": "08080859-2BE8-4E98-A71F-55B05FFF34CD", "versionEndIncluding": "1.07", "vulnerable": true}, {"criteria": "cpe:2.3:a:northgrid:proself:*:*:*:*:gateway:*:*:*", "matchCriteriaId": "62F99405-78A1-4911-8731-AF45ACCEC028", "versionEndIncluding": "1.62", "vulnerable": true}, {"criteria": "cpe:2.3:a:northgrid:proself:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "FFCCF32A-D960-4A11-BAE5-253BDED708E6", "versionEndIncluding": "5.61", "vulnerable": true}, {"criteria": "cpe:2.3:a:northgrid:proself:*:*:*:*:standard:*:*:*", "matchCriteriaId": "EDA2D322-61CB-4252-912E-2DAA674DF9B6", "versionEndIncluding": "5.61", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Improper authentication vulnerability in Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlier, and Proself Mail Sanitize Edition Ver1.07 and earlier allow a remote unauthenticated attacker to log in to the product's Control Panel and perform an unintended operation."}, {"lang": "es", "value": "Una vulnerabilidad de autenticaci\u00f3n incorrecta en Proself Enterprise/Standard Edition Ver5.61 y anteriores, Proself Gateway Edition Ver1.62 y anteriores, y Proself Mail Sanitize Edition Ver1.07 y anteriores permite a un atacante remoto no autenticado iniciar sesi\u00f3n en el Panel de control del producto y realizar una operaci\u00f3n no deseada.\n"}], "id": "CVE-2023-39415", "lastModified": "2024-11-21T08:15:22.563", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-08-18T10:15:11.620", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN19661362/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://www.proself.jp/information/149/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://www.proself.jp/information/150/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN19661362/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.proself.jp/information/149/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.proself.jp/information/150/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}