CVE-2023-34209

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Exposure of Sensitive System Information to an Unauthorized Control Sphere in create template function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to obtain the absolute path via unencrypted VIEWSTATE parameter.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-497

Affected software

Vendor	Product	Versions
EasyUse Digital Technology	MailHunter Ultimate	<= 2023

References

https://zuso.ai/Advisory/ZA-2023-06Third Party Advisory
https://zuso.ai/Advisory/ZA-2023-06Third Party Advisory

Timeline

Published: Oct 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-34218.8Use after free in Media in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a craf CVE-2023-342108.8SQL Injection in create customer group function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to execute CVE-2023-342126.5The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1 CVE-2023-342139.8TN-5900 Series firmware versions v3.3 and prior are vulnerable to command-injection vulnerability. This vulnerability stems from insufficien CVE-2023-342149.8TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injectio CVE-2023-342159.8TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insuffi CVE-2023-342168.1TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injectio CVE-2023-342178.1TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injectio CVE-2023-342189.8In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible CVE-2023-342194.3In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration se CVE-2023-34228.8Use after free in Guest View in Google Chrome prior to 114.0.5735.198 allowed an attacker who convinced a user to install a malicious extens CVE-2023-342205.4In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible