SmarterTools SmarterMail 16.x before build 6985 allows... · CVE-2019-7214 · GitHub Advisory Database · GitHub

SmarterTools SmarterMail 16.x before build 6985 allows...

Critical severity Unreviewed Published May 24, 2022 to the GitHub Advisory Database • Updated Jul 11, 2023

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch.

References

Published by the National Vulnerability Database

Apr 24, 2019

Published to the GitHub Advisory Database May 24, 2022

Last updated Jul 11, 2023

Severity

Critical

9.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H