CVE-2023-23560

In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation

Critical · published January 23, 2023

CVSS v3.1
9.8
EPSS
14%
Percentile
96.5
In the wild
Unconfirmed
What it is

🚨 An SSRF vulnerability is lurking in certain Lexmark products, ready to exploit a lack of input validation! 🔥 This flaw is like a mischievous messenger who delivers any letter without checking the contents, potentially exposing your internal systems to a world of trouble. An attacker could leverage this vulnerability to make unauthorized requests to internal services, accessing sensitive information and even injecting malicious payloads. The consequences could be absolutely devastating, allowing attackers to breach your network security and disrupt critical operations.

Put simply

This flaw is like a mischievous messenger who delivers any letter without checking the contents, potentially exposing your internal systems to a world of trouble. The SSRF vulnerability happens when these Lexmark products fail to adequately validate user input, enabling attackers to manipulate requests sent to internal resources.

What to do

An attacker could leverage this vulnerability to make unauthorized requests to internal services, accessing sensitive information and even injecting malicious payloads. The consequences could be absolutely devastating, allowing attackers to breach your network security and disrupt critical operations. Patch the affected Lexmark products immediately and validate that all user inputs are properly sanitized. Implement network segmentation to limit exposure of internal services to untrusted requests. You've got this! By taking these steps, you're well on your way to securing your systems! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.13866 · 96.5th percentile
Published
2023-01-23T00:00Z
EPSS history
Timeline
  • 23 JAN 00:00Z
    In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation
    cvelistv5