CVE-2023-40599

2023-08-2503:15:08

CWE-1333

[email protected]

web.nvd.nist.gov

cve-2023

redos

mailform pro

denial-of-service

cgi

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

35.1%

JSON

Regular expression Denial-of-Service (ReDoS) exists in multiple add-ons for Mailform Pro CGI 4.3.1.3 and earlier, which allows a remote unauthenticated attacker to cause a denial-of-service condition. Affected add-ons are as follows: call/call.js, prefcodeadv/search.cgi, estimate/estimate.js, search/search.js, suggest/suggest.js, and coupon/coupon.js.

Affected configurations

Vulners

NVD

Node

synck_graphicamailform_pro_cgiMatch4.3.1.3

VendorProductVersionCPE
synck_graphicamailform_pro_cgi4.3.1.3cpe:2.3:a:synck_graphica:mailform_pro_cgi:4.3.1.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
synck_graphica	mailform_pro_cgi	4.3.1.3	cpe:2.3:a:synck_graphica:mailform_pro_cgi:4.3.1.3:::::::*

CNA Affected

[
  {
    "vendor": "SYNCK GRAPHICA",
    "product": "Mailform Pro CGI",
    "versions": [
      {
        "version": "4.3.1.3 and earlier",
        "status": "affected"
      }
    ]
  }
]