How severe is CVE-2023-3233?

This vulnerability has a severity rating of HIGH with a CVSS score of 8.8 out of 10.

What type of vulnerability is CVE-2023-3233?

This is classified as CWE-918, which is a common weakness in software security.

CVE-2023-3233 - HIGH Severity | CVSS 8.8

Vulnerability Description

A vulnerability was found in Zhong Bang CRMEB up to 4.6.0. It has been classified as critical. Affected is the function get_image_base64 of the file api/controller/v1/PublicController.php. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231504. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Related Vulnerabilities

CVE-2014-8943

HIGH

CVSS:8.8(High)

Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter.

CWE-9182014

CVE-2017-1000017

HIGH

CVSS:8.8(High)

phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL server

CWE-9182017

CVE-2018-1000553

HIGH

CVSS:8.8(High)

Trovebox version <= 4.0.0-rc6 contains a Server-Side request forgery vulnerability in webhook component that can result in read or update internal resources. This attack appear to be exploitable via H...

CWE-9182018

CVE-2018-10220

HIGH

CVSS:8.8(High)

Glastopf 3.1.3-dev has SSRF, as demonstrated by the abc.php a parameter. NOTE: the vendor indicates that this is intentional behavior because the product is a web application honeypot, and modules/han...

CWE-9182018

CVE-2018-18646

HIGH

CVSS:8.8(High)

An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows SSRF.

CWE-9182018

CVE-2018-5752

HIGH

CVSS:8.8(High)

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote attackers to conduct server-side r...

CWE-9182018