PT-2019-18466 · Smartertools · Smartermail

Published 2019-04-24 · Updated 2023-07-11 · CVE-2019-7214

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SmarterTools SmarterMail versions prior to build 6985

Description The issue allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch.

Recommendations For versions prior to build 6985, apply the Build 6985 patch to fix the issue. As a temporary workaround, consider restricting access to port 17001 to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2019-7214

Affected Products

Smartermail

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/smartermail_rce.rb · Exploit
• 🔥 https://exploit-db.com/exploits/49216 · Exploit
• 🔥 https://smartertools.com/smartermail/release-notes/current · Exploit
• https://osv.dev/vulnerability/CVE-2019-7214 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7214 · Security Note
• http://packetstormsecurity.com/files/173388/SmarterTools-SmarterMail-Remote-Code-Execution.html · Note
• https://nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-smartermail · Note
• https://t.me/cvenotify/6868 · Telegram Post
• http://packetstormsecurity.com/files/160416/SmarterMail-6985-Remote-Code-Execution.html · Note