PT-2019-7237 · Mailenable · Mailenable

Soroush Dalili · Published 2019-01-16 · Updated 2019-01-17 · CVE-2015-9277

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 8.60

Description The issue allows for Directory Traversal, enabling unauthorized actions such as reading messages of other users, uploading files, and deleting files. This is due to the mishandling of "/../" and "/.. /" sequences.

Recommendations For MailEnable versions prior to 8.60, update to version 8.60 or later to resolve the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2015-9277

Affected Products

Mailenable

References · 5

• 🔥 https://nccgroup.trust/globalassets/our-research/uk/technical-advisories/2015/technical-advisory-multiple-vulnerabilities-in-mailenable.pdf · Exploit
• https://web.archive.org/web/20150329173628/http://mailenable.com/Standard-ReleaseNotes.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-9277 · Security Note
• https://nccgroup.trust/uk/our-research/multiple-vulnerabilities-in-mailenable · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9277 · Note