PT-2019-13025 · Mailenable · Mailenable Enterprise Premium

Published 2019-07-08 · Updated 2019-07-16 · CVE-2019-12925

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions MailEnable Enterprise Premium version 10.23

Description The issue allows authenticated users to perform directory traversal, enabling them to add, remove, or potentially read files in arbitrary folders accessible by the IIS user. This could lead to unauthorized access to other users' credentials, including those of SYSADMIN accounts, as well as reading other users' emails or adding emails or files to other users' accounts.

Recommendations For MailEnable Enterprise Premium version 10.23, update to a newer version that addresses the directory traversal issues to prevent unauthorized access and potential data breaches.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-12925

Affected Products

Mailenable Enterprise Premium

References · 5

• http://mailenable.com/Premium-ReleaseNotes.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12925 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12925 · Vendor Advisory
• https://nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable · Note
• https://t.me/cvenotify/322 · Telegram Post