PT-2019-13024 · Mailenable · Mailenable Enterprise Premium

Publicado 2019-07-08 · Atualizado 2020-08-24 · CVE-2019-12924

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MailEnable Enterprise Premium version 10.23

Description The issue allows an unauthenticated user to exploit an XML External Entity Injection (XXE) vulnerability in the configuration of the XML processor. This could enable an attacker to read any file on the host system. Since all credentials are stored in a cleartext file, it is possible for an attacker to steal all users' credentials, including those of the highest privileged users.

Recommendations For MailEnable Enterprise Premium version 10.23, consider disabling the XML processor or restricting its configuration to prevent XXE attacks until a patch is available. Additionally, restrict access to sensitive files on the host system to minimize the risk of credential theft.

Correção

XXE

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-611

CWE-311

Identificadores relacionados

CVE-2019-12924

Produtos afetados

Mailenable Enterprise Premium

Referências · 5

• https://t.me/cvenotify/321 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-12924 · Nota de Segurança
• http://mailenable.com/Premium-ReleaseNotes.txt · Aviso do Fabricante
• https://nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable · Nota
• https://osv.dev/vulnerability/CVE-2019-12924 · Aviso do Fabricante