Sef Ai Chatbot Platform
Monthly
SQL injection in HAVELSAN's Sef - AI Chatbot Platform, affecting all releases prior to 2.1, lets an attacker who holds a valid low-privilege account feed crafted SQL metacharacters through a user-controllable input that is concatenated into a database query, yielding high confidentiality, integrity, and availability impact (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue is network-reachable with low attack complexity and needs no user interaction, but the vector's PR:L means an attacker must first obtain platform credentials; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1241) does not disclose the specific vulnerable endpoint or parameter. This is a credible, actionable priority rather than a high-CVSS-but-low-risk issue, though real-world exposure is bounded by the narrow deployment base of this specific vendor product.
Improper certificate validation (CWE-295) in HAVELSAN's Sef AI Chatbot Platform before version 2.1 lets an attacker sitting on the network path between client and server impersonate the server in an Adversary-in-the-Middle attack. The flaw is not remotely reachable by a passive attacker: it only becomes exploitable once the adversary already holds an on-path position (untrusted Wi-Fi, shared network, compromised gateway or malicious transit infrastructure), which is why CVSS rates it AC:H despite PR:N and UI:N. Successful interception yields high confidentiality and integrity impact - chat content, credentials and session material traversing the TLS channel can be read or manipulated - with no availability impact; no public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV), giving an assessed score of 7.4.
Missing authorization (CWE-862) in HAVELSAN's Sef - AI Chatbot Platform allows an authenticated, low-privileged user to reach functionality that is not properly constrained by access control lists, resulting in unauthorized access to data (confidentiality impact only, no integrity or availability effect). The vulnerability affects all versions before 2.1 and carries a moderate CVSS 3.1 base score of 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning exploitation requires valid credentials and additional non-trivial conditions - the high attack complexity reflects the need for specific request state, timing, or knowledge of protected object identifiers rather than a single trivial request. There is no public exploit code and no confirmed active exploitation at time of analysis; the issue was reported by TR-CERT and is documented in the Turkish national CERT advisory TR-26-1241.
Server-side request forgery (SSRF) in HAVELSAN's Sef AI Chatbot Platform before version 2.1 allows an authenticated attacker with high privileges (PR:H) to cause the server to make requests to arbitrary URLs, potentially reading internal resources reachable from the server. This moderate-severity flaw (CVSS 4.9) is network-reachable without user interaction, but requires a privileged session, limiting exploitation to trusted or compromised elevated accounts. No public exploit code or confirmed active exploitation has been identified at time of analysis.
SQL injection in HAVELSAN's Sef - AI Chatbot Platform, affecting all releases prior to 2.1, lets an attacker who holds a valid low-privilege account feed crafted SQL metacharacters through a user-controllable input that is concatenated into a database query, yielding high confidentiality, integrity, and availability impact (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue is network-reachable with low attack complexity and needs no user interaction, but the vector's PR:L means an attacker must first obtain platform credentials; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1241) does not disclose the specific vulnerable endpoint or parameter. This is a credible, actionable priority rather than a high-CVSS-but-low-risk issue, though real-world exposure is bounded by the narrow deployment base of this specific vendor product.
Improper certificate validation (CWE-295) in HAVELSAN's Sef AI Chatbot Platform before version 2.1 lets an attacker sitting on the network path between client and server impersonate the server in an Adversary-in-the-Middle attack. The flaw is not remotely reachable by a passive attacker: it only becomes exploitable once the adversary already holds an on-path position (untrusted Wi-Fi, shared network, compromised gateway or malicious transit infrastructure), which is why CVSS rates it AC:H despite PR:N and UI:N. Successful interception yields high confidentiality and integrity impact - chat content, credentials and session material traversing the TLS channel can be read or manipulated - with no availability impact; no public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV), giving an assessed score of 7.4.
Missing authorization (CWE-862) in HAVELSAN's Sef - AI Chatbot Platform allows an authenticated, low-privileged user to reach functionality that is not properly constrained by access control lists, resulting in unauthorized access to data (confidentiality impact only, no integrity or availability effect). The vulnerability affects all versions before 2.1 and carries a moderate CVSS 3.1 base score of 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning exploitation requires valid credentials and additional non-trivial conditions - the high attack complexity reflects the need for specific request state, timing, or knowledge of protected object identifiers rather than a single trivial request. There is no public exploit code and no confirmed active exploitation at time of analysis; the issue was reported by TR-CERT and is documented in the Turkish national CERT advisory TR-26-1241.
Server-side request forgery (SSRF) in HAVELSAN's Sef AI Chatbot Platform before version 2.1 allows an authenticated attacker with high privileges (PR:H) to cause the server to make requests to arbitrary URLs, potentially reading internal resources reachable from the server. This moderate-severity flaw (CVSS 4.9) is network-reachable without user interaction, but requires a privileged session, limiting exploitation to trusted or compromised elevated accounts. No public exploit code or confirmed active exploitation has been identified at time of analysis.