PT-2019-11525 · Mailcleaner · Mailcleaner

Published 2019-07-18 · Updated 2020-08-24 · CVE-2019-1010246

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: MailCleaner versions prior to c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9

Description: The issue allows for unauthenticated disclosure of MySQL database password information. This can lead to the disclosure of MySQL database content, including usernames and passwords. The problem is specifically with the API call in the allowAction() function in NewslettersController.php, which can be exploited via an HTTP GET request.

Recommendations: For MailCleaner versions prior to c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9, update to version c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 to resolve the issue. As a temporary workaround, consider restricting access to the allowAction() function in NewslettersController.php to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2019-1010246

Affected Products

Mailcleaner

References · 3

• https://github.com/MailCleaner/MailCleaner/commit/c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 · Patch
• https://osv.dev/vulnerability/CVE-2019-1010246 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010246 · Security Note