PT-2022-16553 · Snapt · Snapt Aria

Published 2022-03-21 · Updated 2022-03-29 · CVE-2022-24236

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Snapt Aria version 12.8

Description The issue is related to insecure permissions, allowing unauthenticated attackers to send emails from spoofed users' accounts.

Recommendations For Snapt Aria version 12.8, update to a version that addresses the insecure permissions issue to prevent unauthenticated attackers from sending emails from spoofed users' accounts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-24236

Affected Products

Snapt Aria

References · 5

• 🔥 https://cryptnetix.com/blog/2022/03/19/Snapt-Aria-Vulnerability-Disclosure.html · Exploit
• https://snapt.net/platforms/aria-adc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24236 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24236 · Security Note
• https://t.me/cibsecurity/39329 · Telegram Post