CVE-2023-37290

Summary

CVE-2023-37290 is a vulnerability affecting the InfoDoc Document On-line Submission and Approval System. The issue lies in insufficient restrictions on HTML tags during the system's HTML to PDF conversion process. An attacker, without authentication, can exploit this vulnerability by introducing malicious HTML tags, such as iframe. This leads to Server-Side Request Forgery (SSRF) attacks, enabling unauthorized access to internal system files and potentially revealing the internal network topology.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.