PT-2025-34239 · Unknown · Spamtitan Email Security Gateway

Published 2025-08-21 · Updated 2025-10-09 · CVE-2024-45438

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SpamTitan Email Security Gateway versions 8.00.0 through 8.00.100 SpamTitan Email Security Gateway versions 8.01.0 through 8.01.13

Description: The quarantine.php file within the SpamTitan interface allows unauthenticated users to trigger account-level actions using a crafted GET request. When a non-existent email address is provided as the email parameter, the system automatically creates a user record and associates quarantine settings with it, without authentication.

Recommendations: SpamTitan Email Security Gateway versions 8.00.0 through 8.00.100: Upgrade to version 8.00.101 or later. SpamTitan Email Security Gateway versions 8.01.0 through 8.01.13: Upgrade to version 8.01.14 or later.

Fix

Missing Authentication

Improper Access Control

Weakness Enumeration

CWE-306

CWE-284

Related Identifiers

CVE-2024-45438

Affected Products

Spamtitan Email Security Gateway

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-45438 · Security Note
• https://seralys.com/research/CVE-2024-45438.txt · Note
• https://seclists.org/fulldisclosure/2025/Sep/15 · Note
• http://seclists.org/fulldisclosure/2025/Sep/15 · Note
• https://twitter.com/CVEnew/status/1958603403782930858 · Twitter Post
• https://docs.titanhq.com/en/13161-spamtitan-release-notes.html · Note
• https://twitter.com/transilienceai/status/1965690822499729464 · Twitter Post
• https://titanhq.com/email-protection · Note
• https://t.me/cveNotify/133022 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1958634885070889292 · Twitter Post
• https://twitter.com/samilaiho/status/1965644845403234771 · Twitter Post
• https://t.me/cveNotify/137959 · Telegram Post