CVE-2023-7327

Deeper analysis

Ozeki SMS Gateway versions up to and including 10.3.208 contain a path traversal vulnerability tracked as CVE-2023-7327 and assigned CWE-22. The flaw permits URL-encoded directory traversal sequences in requests to the gateway, enabling an attacker to retrieve arbitrary files from the underlying filesystem using the service account privileges and resulting in exposure of sensitive information. The vulnerability carries a CVSS 4.0 score of 8.7 reflecting network attack vector, low complexity, and no required authentication or user interaction.

An unauthenticated remote attacker can exploit the issue by submitting crafted HTTP requests containing traversal sequences to read configuration files, credentials, or other sensitive data stored on the host. Successful exploitation yields direct disclosure of information without needing prior access or elevated privileges on the target system. The current EPSS score of 0.1764 shows no material increase from its recorded peak.