CVE-2023-40747 - Vulnerability Details - OpenCVE

Directory traversal vulnerability exists in A.K.I Software's PMailServer/PMailServer2 products' CGIs included in Internal Simple Webserver. If this vulnerability is exploited, a remote attacker may access arbitrary files outside DocumentRoot.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Aki	Pmman.exe\/enterprise Edition\/ Pmman.exe\/pro Edition\/ Pmman.exe\/pro Plus Imap4 Edition\/ Pmman.exe\/standard Edition\/ Pmman.exe\/standard Plus Imap4 Edition

No data.

No data.

References

Link	Providers
https://akisoftware.com/Vulnerability202301.html
https://jvn.jp/en/jp/JVN92720882/

History

Tue, 18 Mar 2025 19:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Aki Aki pmman.exe\/enterprise Edition\/ Aki pmman.exe\/pro Edition\/ Aki pmman.exe\/pro Plus Imap4 Edition\/ Aki pmman.exe\/standard Edition\/ Aki pmman.exe\/standard Plus Imap4 Edition
Weaknesses		CWE-22
CPEs		cpe:2.3:a:aki:pmman.exe\/enterprise_edition\/:::::::: cpe:2.3:a:aki:pmman.exe\/pro_edition\/:::::::: cpe:2.3:a:aki:pmman.exe\/pro_plus_imap4_edition\/:::::::: cpe:2.3:a:aki:pmman.exe\/standard_edition\/:::::::: cpe:2.3:a:aki:pmman.exe\/standard_plus_imap4_edition::::::::
Vendors & Products		Aki Aki pmman.exe\/enterprise Edition\/ Aki pmman.exe\/pro Edition\/ Aki pmman.exe\/pro Plus Imap4 Edition\/ Aki pmman.exe\/standard Edition\/ Aki pmman.exe\/standard Plus Imap4 Edition
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2024-03-18T00:32:58.218Z

Updated: 2025-03-18T19:08:32.049Z

Reserved: 2023-08-29T05:55:03.449Z

Link: CVE-2023-40747

Vulnrichment

Updated: 2024-08-02T18:46:10.362Z

NVD

Status : Awaiting Analysis

Published: 2024-03-18T01:15:48.440

Modified: 2025-03-18T20:15:20.477

Link: CVE-2023-40747

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-40747", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2023-08-29T05:55:03.449Z", "datePublished": "2024-03-18T00:32:58.218Z", "dateUpdated": "2025-03-18T19:08:32.049Z"}, "containers": {"cna": {"affected": [{"vendor": "A.K.I Software", "product": "pmman.exe (Standard edition)", "versions": [{"version": "2.5.1.12154 and earlier", "status": "affected"}]}, {"vendor": "A.K.I Software", "product": "pmman.exe (Pro edition)", "versions": [{"version": "2.5.1.12155 and earlier", "status": "affected"}]}, {"vendor": "A.K.I Software", "product": "pmman.exe (Standard + IMAP4 edition)", "versions": [{"version": "2.5.1.12156 and earlier", "status": "affected"}]}, {"vendor": "A.K.I Software", "product": "pmman.exe (Pro + IMAP4 edition)", "versions": [{"version": "2.5.1.12157 and earlier", "status": "affected"}]}, {"vendor": "A.K.I Software", "product": "pmman.exe (Enterprise edition)", "versions": [{"version": "2.5.1.12158 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability exists in A.K.I Software's PMailServer/PMailServer2 products' CGIs included in Internal Simple Webserver. If this vulnerability is exploited, a remote attacker may access arbitrary files outside DocumentRoot."}], "problemTypes": [{"descriptions": [{"description": "Directory traversal", "lang": "en", "type": "text"}]}], "references": [{"url": "https://akisoftware.com/Vulnerability202301.html"}, {"url": "https://jvn.jp/en/jp/JVN92720882/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-03-18T00:32:58.218Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "affected": [{"vendor": "aki", "product": "pmman.exe\\/standard_edition\\/", "cpes": ["cpe:2.3:a:aki:pmman.exe\\/standard_edition\\/:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2.5.1.12154", "versionType": "custom"}]}, {"vendor": "aki", "product": "pmman.exe\\/pro_edition\\/", "cpes": ["cpe:2.3:a:aki:pmman.exe\\/pro_edition\\/:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2.5.1.12155", "versionType": "custom"}]}, {"vendor": "aki", "product": "pmman.exe\\/standard_plus_imap4_edition", "cpes": ["cpe:2.3:a:aki:pmman.exe\\/standard_plus_imap4_edition:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2.5.1.12156", "versionType": "custom"}]}, {"vendor": "aki", "product": "pmman.exe\\/pro_plus_imap4_edition\\/", "cpes": ["cpe:2.3:a:aki:pmman.exe\\/pro_plus_imap4_edition\\/:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2.5.1.12157", "versionType": "custom"}]}, {"vendor": "aki", "product": "pmman.exe\\/enterprise_edition\\/", "cpes": ["cpe:2.3:a:aki:pmman.exe\\/enterprise_edition\\/:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2.5.1.12158", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-03-18T15:00:53.605686Z", "id": "CVE-2023-40747", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-18T19:08:32.049Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:46:10.362Z"}, "title": "CVE Program Container", "references": [{"url": "https://akisoftware.com/Vulnerability202301.html", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN92720882/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://akisoftware.com/Vulnerability202301.html", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN92720882/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:46:10.362Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-40747", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-18T15:00:53.605686Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:aki:pmman.exe\\/standard_edition\\/:*:*:*:*:*:*:*:*"], "vendor": "aki", "product": "pmman.exe\\/standard_edition\\/", "versions": [{"status": "affected", "version": "0", "lessThan": "2.5.1.12154", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:aki:pmman.exe\\/pro_edition\\/:*:*:*:*:*:*:*:*"], "vendor": "aki", "product": "pmman.exe\\/pro_edition\\/", "versions": [{"status": "affected", "version": "0", "lessThan": "2.5.1.12155", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:aki:pmman.exe\\/standard_plus_imap4_edition:*:*:*:*:*:*:*:*"], "vendor": "aki", "product": "pmman.exe\\/standard_plus_imap4_edition", "versions": [{"status": "affected", "version": "0", "lessThan": "2.5.1.12156", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:aki:pmman.exe\\/pro_plus_imap4_edition\\/:*:*:*:*:*:*:*:*"], "vendor": "aki", "product": "pmman.exe\\/pro_plus_imap4_edition\\/", "versions": [{"status": "affected", "version": "0", "lessThan": "2.5.1.12157", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:aki:pmman.exe\\/enterprise_edition\\/:*:*:*:*:*:*:*:*"], "vendor": "aki", "product": "pmman.exe\\/enterprise_edition\\/", "versions": [{"status": "affected", "version": "0", "lessThan": "2.5.1.12158", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-19T16:23:50.284Z"}}], "cna": {"affected": [{"vendor": "A.K.I Software", "product": "pmman.exe (Standard edition)", "versions": [{"status": "affected", "version": "2.5.1.12154 and earlier"}]}, {"vendor": "A.K.I Software", "product": "pmman.exe (Pro edition)", "versions": [{"status": "affected", "version": "2.5.1.12155 and earlier"}]}, {"vendor": "A.K.I Software", "product": "pmman.exe (Standard + IMAP4 edition)", "versions": [{"status": "affected", "version": "2.5.1.12156 and earlier"}]}, {"vendor": "A.K.I Software", "product": "pmman.exe (Pro + IMAP4 edition)", "versions": [{"status": "affected", "version": "2.5.1.12157 and earlier"}]}, {"vendor": "A.K.I Software", "product": "pmman.exe (Enterprise edition)", "versions": [{"status": "affected", "version": "2.5.1.12158 and earlier"}]}], "references": [{"url": "https://akisoftware.com/Vulnerability202301.html"}, {"url": "https://jvn.jp/en/jp/JVN92720882/"}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability exists in A.K.I Software's PMailServer/PMailServer2 products' CGIs included in Internal Simple Webserver. If this vulnerability is exploited, a remote attacker may access arbitrary files outside DocumentRoot."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Directory traversal"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-03-18T00:32:58.218Z"}}}, "cveMetadata": {"cveId": "CVE-2023-40747", "state": "PUBLISHED", "dateUpdated": "2025-03-18T19:08:32.049Z", "dateReserved": "2023-08-29T05:55:03.449Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2024-03-18T00:32:58.218Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}