PT-2025-34239 · Unknown · Spamtitan Email Security Gateway

CVE-2024-45438 · Publicado 2025-08-21 · Atualizado 2025-10-09

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SpamTitan Email Security Gateway versions 8.00.0 through 8.00.100 SpamTitan Email Security Gateway versions 8.01.0 through 8.01.13

Description: The quarantine.php file within the SpamTitan interface allows unauthenticated users to trigger account-level actions using a crafted GET request. When a non-existent email address is provided as the email parameter, the system automatically creates a user record and associates quarantine settings with it, without authentication.

Recommendations: SpamTitan Email Security Gateway versions 8.00.0 through 8.00.100: Upgrade to version 8.00.101 or later. SpamTitan Email Security Gateway versions 8.01.0 through 8.01.13: Upgrade to version 8.01.14 or later.

Correção

Missing Authentication

Improper Access Control

Enumeração de Fraquezas

CWE-306

CWE-284

Identificadores relacionados

CVE-2024-45438

Produtos afetados

Spamtitan Email Security Gateway

Referências · 12

• https://seralys.com/research/CVE-2024-45438.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2024-45438 · Nota de Segurança
• https://seclists.org/fulldisclosure/2025/Sep/15 · Nota
• http://seclists.org/fulldisclosure/2025/Sep/15 · Nota
• https://twitter.com/CVEnew/status/1958603403782930858 · Publicação no Twitter
• https://docs.titanhq.com/en/13161-spamtitan-release-notes.html · Nota
• https://twitter.com/transilienceai/status/1965690822499729464 · Publicação no Twitter
• https://titanhq.com/email-protection · Nota
• https://t.me/cveNotify/133022 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1958634885070889292 · Publicação no Twitter
• https://twitter.com/samilaiho/status/1965644845403234771 · Publicação no Twitter
• https://t.me/cveNotify/137959 · Publicação no Telegram