PT-2024-20965 · Microsoft · Winmail

Drunkbaby · Published 2024-03-09 · Updated 2025-09-18 · CVE-2024-25501

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WinMail versions 5.1 and earlier WinMail version 7.1

Description An issue allows a remote attacker to execute arbitrary code via a crafted script to the email parameter.

Recommendations For WinMail versions 5.1 and earlier, update to a version later than 5.1 to resolve the issue. For WinMail version 7.1, update to a version later than 7.1 to resolve the issue. As a temporary workaround, consider restricting access to the email parameter to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-25501

Affected Products

Winmail

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-25501 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25501 · Vendor Advisory
• https://gist.github.com/Drun1baby/8270239bed2952dbd99cc8d4262728e8 · Note
• https://t.me/cvenotify/114750 · Telegram Post
• https://t.me/cvenotify/73431 · Telegram Post
• https://t.me/cveNotify/135827 · Telegram Post
• https://twitter.com/CVEnew/status/1766367704938647874 · Twitter Post