CVE-2023-23327
MediumCVSS 4.9Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
An information disclosure vulnerability exists in AvantFAX 3.3.7. Backups of sent/received faxes and database backups are stored with the current date as the filename and hosted on the web server without access controls.
Risk Assessment
An attacker can access sensitive fax data and database backups, leading to leakage of business information or personal data.
Recommendation
Immediately update AvantFAX to the latest version and configure proper access controls for backup directories.
Other vulnerabilities in AvantFAX
See all- CVE-2023-23328High
An authenticated user can bypass PHP file type validation in FileUpload.php by uploading a specially crafted PHP file. This vulnerability affects AvantFAX version 3.3.7.
- CVE-2023-23326Medium
A stored Cross-Site Scripting (XSS) vulnerability in AvantFAX 3.3.7 allows an authenticated low-privilege user to inject arbitrary JavaScript into their email address, which executes when an administrator views the admin dashboard.
Original NVD description (English source)
An Information Disclosure vulnerability exists in AvantFAX 3.3.7. Backups of the AvantFAX sent/received faxes, and database backups are stored using the current date as the filename and hosted on the web server without access controls.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS