PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-5443 EDM Informatics CVE debrief

CVE-2023-5443 is a high-severity information-disclosure issue in E-Invoice affecting versions before 2.1. According to NVD and USOM references, the flaw can leak account-related information through outbound error messages and alert signals, enabling account footprinting without authentication.

Vendor
EDM Informatics
Product
E-invoice
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2023-10-27
Original CVE updated
2026-05-21
Advisory published
2023-10-27
Advisory updated
2026-05-21

Who should care

Organizations running E-Invoice instances before 2.1, especially administrators, security teams, and anyone responsible for user-account protection or application error handling.

Technical summary

NVD lists the issue as affecting cpe:2.3:a:e-invoice_project:e-invoice with versionEndExcluding 2.1, and assigns CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a remotely reachable, unauthenticated confidentiality issue. USOM’s advisory maps the weakness to CWE-1320 and describes improper protection for outbound error messages and alert signals, which can disclose account-related information used for footprinting.

Defensive priority

High. The vulnerability is network-reachable, requires no privileges or user interaction, and is rated HIGH with confidentiality impact only, which makes it a strong candidate for rapid patching and external exposure review.

Recommended defensive actions

  • Upgrade E-Invoice to version 2.1 or later as soon as possible.
  • Review application error messages and alert signals to ensure they do not reveal account existence or other sensitive identifiers.
  • Check exposed endpoints and logs for signs of account-enumeration or footprinting activity around the disclosure window and afterward.
  • Validate that any authentication, registration, password reset, or lookup workflows return consistent, non-enumerable responses.
  • If the product was exposed externally before remediation, assess whether additional monitoring or user-notification steps are warranted.

Evidence notes

The NVD record for CVE-2023-5443 lists the affected range as E-Invoice versions before 2.1 and provides the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. USOM references identify the issue as improper protection for outbound error messages and alert signals and associate it with CWE-1320. The advisory links in the source corpus are dated 2023-10-27, which is the CVE publication date used here.

Official resources

Publicly disclosed on 2023-10-27, with the source record later modified on 2026-05-21. The issue is documented in NVD and USOM advisories; no KEV entry is listed in the supplied data.