PT-2019-13025 · Mailenable · Mailenable Enterprise Premium

Publicado 2019-07-08 · Atualizado 2019-07-16 · CVE-2019-12925

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions MailEnable Enterprise Premium version 10.23

Description The issue allows authenticated users to perform directory traversal, enabling them to add, remove, or potentially read files in arbitrary folders accessible by the IIS user. This could lead to unauthorized access to other users' credentials, including those of SYSADMIN accounts, as well as reading other users' emails or adding emails or files to other users' accounts.

Recommendations For MailEnable Enterprise Premium version 10.23, update to a newer version that addresses the directory traversal issues to prevent unauthorized access and potential data breaches.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-12925

Produtos afetados

Mailenable Enterprise Premium

Referências · 5

• http://mailenable.com/Premium-ReleaseNotes.txt · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12925 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12925 · Aviso do Fabricante
• https://nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable · Nota
• https://t.me/cvenotify/322 · Publicação no Telegram