high7.5Public exploit code
CVE-2022-40319
The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a modified email address in a wa.exe URL.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- LISTSERV 17 - Insecure Direct Object Reference (IDOR)2023-03-30 · webapps · cgi
Impact
The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a modified email address in a wa.exe URL. The impact is unauthorized modification of a victim's LISTSERV account.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lsoft | Listserv | Version 17.0 |