PT-2023-18391 · M-Filter · M-Filter

Published 2023-01-17 · Updated 2023-01-25 · CVE-2023-22278

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions m-FILTER versions prior to 5.70R01 (Ver.5 Series) m-FILTER versions prior to 4.87R04 (Ver.4 Series)

Description The issue allows a remote unauthenticated attacker to bypass authentication and send users' unintended email when email is being sent under certain conditions. Attacks exploiting this issue have been observed.

Recommendations For m-FILTER versions prior to 5.70R01 (Ver.5 Series), update to version 5.70R01 or later. For m-FILTER versions prior to 4.87R04 (Ver.4 Series), update to version 4.87R04 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-22278

Affected Products

M-Filter

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-22278 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22278 · Vendor Advisory
• https://t.me/cibsecurity/56573 · Telegram Post
• https://jvn.jp/en/jp/JVN55675303/index.html · Note
• https://t.me/cvenotify/42774 · Telegram Post