PT-2024-37010 · Softnext · Softnext Mail Sqr Expert+1

Cyku Hong · Published 2024-07-29 · Updated 2024-09-13 · CVE-2024-5670

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Softnext Mail SQR Expert (affected versions not specified) Softnext Mail Archiving Expert (affected versions not specified)

Description The web services of Softnext's products do not properly validate user input, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the remote server.

Recommendations For Softnext Mail SQR Expert, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Softnext Mail Archiving Expert, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-5670

Affected Products

Softnext Mail Archiving Expert

Softnext Mail Sqr Expert

References · 8

• https://osv.dev/vulnerability/CVE-2024-5670 · Vendor Advisory
• https://twcert.org.tw/tw/cp-132-7958-817f4-1.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5670 · Security Note
• https://twcert.org.tw/en/cp-139-7959-09d0e-2.html · Vendor Advisory
• https://t.me/cvenotify/87695 · Telegram Post
• https://t.me/cvedetector/1797 · Telegram Post
• https://t.me/cvenotify/94509 · Telegram Post
• https://t.me/pentestingnews/49739 · Telegram Post