« Volver al listado

CVE-2009-5131

Estado: ModificadaMedia (5)—

The Receive Service in Websense Email Security before 7.1 does not recognize domain extensions in the blacklist, which allows remote attackers to bypass intended access restrictions and send e-mail messages via an SMTP session.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Websense — Websense Email Security

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-5131",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-08-26T19:55:01.183",
  "references": [
    {
      "url": "http://www.websense.com/support/article/t-kbarticle/Release-Notes-for-Websense-Email-Security-v7-1",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.websense.com/support/article/t-kbarticle/Release-Notes-for-Websense-Email-Security-v7-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Receive Service in Websense Email Security before 7.1 does not recognize domain extensions in the blacklist, which allows remote attackers to bypass intended access restrictions and send e-mail messages via an SMTP session."
    },
    {
      "lang": "es",
      "value": "Receive Service en Websense Email Security anterior a v7.1 no reconoce las extensiones de dominio en una lista negra (blacklist), lo cual permite a atacantes remotos saltarse las restricciones de acceso establecidas y enviar mensajes de correo electrónico a través de una sesión SMTP."
    }
  ],
  "lastModified": "2026-06-16T23:15:08.523",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:websense:websense_email_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F2D8740-2BD8-47F9-B76A-D40D944997D6",
              "versionEndIncluding": "7.0"
            },
            {
              "criteria": "cpe:2.3:a:websense:websense_email_security:6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B57542A-390F-4447-BD4A-CDD758D715D6"
            },
            {
              "criteria": "cpe:2.3:a:websense:websense_email_security:6.1:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9949AE6C-A57E-4B37-831E-DB4C462F5FB4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}