CVE-2023-39415

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper authentication vulnerability in Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlier, and Proself Mail Sanitize Edition Ver1.07 and earlier allow a remote unauthenticated attacker to log in to the product's Control Panel and perform an unintended operation.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
North Grid Corporation	Proself Enterprise/Standard Edition	Ver5.61 and earlier
North Grid Corporation	Proself Gateway Edition	Ver1.62 and earlier
North Grid Corporation	Proself Mail Sanitize Edition	Ver1.07 and earlier
northgrid	proself_enterprise_standard_edition	< 5.61
northgrid	proself_gateway_edition	< 1.62
northgrid	proself_mail_sanitize_edition	< 1.07

References

https://jvn.jp/en/jp/JVN19661362/Third Party Advisory
https://www.proself.jp/information/149/Vendor Advisory
https://www.proself.jp/information/150/Vendor Advisory
https://jvn.jp/en/jp/JVN19661362/Third Party Advisory
https://www.proself.jp/information/149/Vendor Advisory
https://www.proself.jp/information/150/Vendor Advisory

Timeline

Published: Aug 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-394167.2Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlier, and Proself Mail Sanitize Edition Ver1 CVE-2023-394178.8IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside CVE-2023-394184.3A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies define CVE-2023-394197.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bound CVE-2023-39427.5An 'SQL Injection' vulnerability, due to improper neutralization of special elements used in SQL commands, exists in ZKTeco-based OEM device CVE-2023-394208.8The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" ac CVE-2023-394217.7The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services suc CVE-2023-394229.8The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are how CVE-2023-394239.1The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator CVE-2023-394248.8A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote attacker to upload arbitrary cont CVE-2023-394257.8Improper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potentially enable escalatio CVE-2023-394277.8In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack proper validation o