PT-2019-18465 · Smartertools · Smartermail

Publicado 2019-04-24 · Atualizado 2019-04-30 · CVE-2019-7213

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterMail versions prior to build 6985

Description The issue allows an authenticated user to perform directory traversal, enabling them to delete arbitrary files or create files in new folders in arbitrary locations on the mail server. This could potentially lead to command execution on the server, for example, by placing files inside the web directories.

Recommendations For versions prior to build 6985, update to build 6985 or later to resolve the issue. As a temporary workaround, consider restricting file access and creation capabilities for authenticated users to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-7213

Produtos afetados

Smartermail

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-7213 · Nota de Segurança
• https://nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-smartermail · Nota
• https://smartertools.com/smartermail/release-notes/current · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-7213 · Aviso do Fabricante