PT-2019-18463 · Smartertools · Smartermail

Published 2019-04-24 · Updated 2019-04-29 · CVE-2019-7211

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterMail versions 16.x before build 6995

Description The issue allows JavaScript code to be executed on the application, potentially leading to stored XSS. This can occur when a user opens a malicious email or views a malicious file attachment.

Recommendations For versions 16.x before build 6995, update to build 6995 or later to resolve the issue. As a temporary workaround, consider restricting access to email and file attachments from untrusted sources until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-7211

Affected Products

Smartermail

References · 4

• https://osv.dev/vulnerability/CVE-2019-7211 · Vendor Advisory
• https://smartertools.com/smartermail/release-notes/current · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7211 · Security Note
• https://nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-smartermail · Note