CVE-2023-39416

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlier, and Proself Mail Sanitize Edition Ver1.07 and earlier allow a remote authenticated attacker with an administrative privilege to execute arbitrary OS commands.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
North Grid Corporation	Proself Enterprise/Standard Edition	Ver5.61 and earlier
North Grid Corporation	Proself Gateway Edition	Ver1.62 and earlier
North Grid Corporation	Proself Mail Sanitize Edition	Ver1.07 and earlier
north_grid_corporation	proself_enterprise_standard_edition	< 5.61
north_grid_corporation	proself_gateway_edition	< 1.62
north_grid_corporation	proself_mail_sanitize_edition	< 1.07

References

https://jvn.jp/en/jp/JVN19661362/Third Party Advisory
https://www.proself.jp/information/149/Vendor Advisory
https://www.proself.jp/information/150/Vendor Advisory
https://jvn.jp/en/jp/JVN19661362/Third Party Advisory
https://www.proself.jp/information/149/Vendor Advisory
https://www.proself.jp/information/150/Vendor Advisory

Timeline

Published: Aug 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-394178.8IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside CVE-2023-394184.3A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies define CVE-2023-394197.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bound CVE-2023-39427.5An 'SQL Injection' vulnerability, due to improper neutralization of special elements used in SQL commands, exists in ZKTeco-based OEM device CVE-2023-394208.8The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" ac CVE-2023-394217.7The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services suc CVE-2023-394229.8The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are how CVE-2023-394239.1The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator CVE-2023-394248.8A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote attacker to upload arbitrary cont CVE-2023-394257.8Improper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potentially enable escalatio CVE-2023-394277.8In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack proper validation o CVE-2023-394295.4Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary s