PT-2019-11645 · Mailstore · Mailstore Server Service Provider Edition+1

Publicado 2019-12-31 · Atualizado 2020-08-24 · CVE-2019-10229

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: MailStore Server versions 9.x through 11.x before 11.2.2 MailStore Server Service Provider Edition versions 9.x through 11.x before 11.2.2

Description: An issue allows an attacker to login as an existing user with an arbitrary password on the second login attempt when the directory service is set to Generic LDAP.

Recommendations: For MailStore Server versions 9.x through 11.x before 11.2.2, update to version 11.2.2 or later. For MailStore Server Service Provider Edition versions 9.x through 11.x before 11.2.2, update to version 11.2.2 or later. As a temporary workaround, consider restricting access to the Generic LDAP directory service until a patch is available.

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CVE-2019-10229

Produtos afetados

Mailstore Server

Mailstore Server Service Provider Edition

Referências · 3

• https://help.mailstore.com/security/MAILSTORE-SA-2019-01.txt · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10229 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10229 · Nota de Segurança