PT-2019-13026 · Mailenable · Mailenable Enterprise Premium

Published 2019-07-08 · Updated 2020-08-24 · CVE-2019-12926

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MailEnable Enterprise Premium version 10.23

Description The issue concerns inadequate access control checks in multiple areas, allowing users to perform unauthorized actions and access restricted parts of the application despite having insufficient permissions.

Recommendations For MailEnable Enterprise Premium version 10.23, consider restricting access to sensitive areas of the application and implementing additional access control checks to prevent unauthorized actions until a fix is available. As a temporary workaround, review and adjust user permissions to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2019-12926

Affected Products

Mailenable Enterprise Premium

References · 5

• http://mailenable.com/Premium-ReleaseNotes.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12926 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12926 · Security Note
• https://nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable · Note
• https://t.me/cvenotify/323 · Telegram Post