CVE-2023-33524
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
Tamale RMS version < 23.1 from Advent/SSC Inc. is vulnerable to Directory Traversal. An attacker can access contact information, including usernames, email addresses, and other internal data stored within the web app.
Risk Assessment
The risk associated with this vulnerability is the potential exposure of sensitive information, which could lead to further attacks on the system or identity theft.
Recommendation
It is recommended to update Tamale RMS to version 23.1 or later to mitigate this vulnerability and conduct a security audit of the application.
Original NVD description (English source)
Advent/SSC Inc. Tamale RMS < 23.1 is vulnerable to Directory Traversal. If one traverses to the affected URL, one enumerates Contact information on the host which contains usernames, e-mail addresses, and other internal information stored within the web app.