title: Insertion of Sensitive Information into Externally-Accessible File or Directory in BVRP Software SLmail
description: An information exposure vulnerability has been found, the exploitation of which could allow a remote user to retrieve sensitive information stored on the server such as credential files, configuration files, application files, etc., simply by appending any of the following parameters to the end of the URL: %00 %0a, %20, %2a, %a0, %aa, %c0 and %ca.
problem types: CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
affected:
{
defaultStatus: unaffected
product: SLmail
vendor: BVRP Software
versions:
status: affected, version: 5.5.0.4433
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: There is no reported solution at the moment.