PT-2019-7237 · Mailenable · Mailenable

Soroush Dalili · Publicado 2019-01-16 · Atualizado 2019-01-17 · CVE-2015-9277

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 8.60

Description The issue allows for Directory Traversal, enabling unauthorized actions such as reading messages of other users, uploading files, and deleting files. This is due to the mishandling of "/../" and "/.. /" sequences.

Recommendations For MailEnable versions prior to 8.60, update to version 8.60 or later to resolve the issue.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2015-9277

Produtos afetados

Mailenable

Referências · 5

• 🔥 https://nccgroup.trust/globalassets/our-research/uk/technical-advisories/2015/technical-advisory-multiple-vulnerabilities-in-mailenable.pdf · Exploit
• https://nccgroup.trust/uk/our-research/multiple-vulnerabilities-in-mailenable · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9277 · Nota
• https://web.archive.org/web/20150329173628/http://mailenable.com/Standard-ReleaseNotes.txt · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-9277 · Nota de Segurança