CVEvulnerability

CVE-2019-12924

9.8 CRITICAL Published 2019-07-08 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-07-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-311, CWE-611

Description

MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploited by an unauthenticated user. It was possible for an attacker to use a vulnerability in the configuration of the XML processor to read any file on the host system. Because all credentials were stored in a cleartext file, it was possible to steal all users' credentials (including the highest privileged users).

Affected configurations

• mailenable mailenable (>= 6.0 < 6.90) • mailenable mailenable (>= 7.0 < 7.62) • mailenable mailenable (>= 8.00 < 8.64) • mailenable mailenable (>= 9.0 < 9.83) • mailenable mailenable (>= 10.00 < 10.24)

Related

Weakness · CWE (2)

  • CWE-311 Missing Encryption of Sensitive Data weakness
  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References