« Volver al listado

CVE-2019-12925

Estado: ModificadaAlta (8.1)—

MailEnable Enterprise Premium versión 10.23, fue vulnerable a múltiples problemas de salto de directorio, con lo cual los usuarios identificados podrían agregar, eliminar o potencialmente leer archivos en carpetas arbitrarias accesibles mediante el usuario IIS. Esto podría conllevar a leer las credenciales de otros usuarios, incluyendo las de las cuentas de SYSADMIN, leer los correos electrónicos de otros usuarios o agregar correos electrónicos o archivos en las cuentas de otros usuarios.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mailenable — Mailenable

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-12925",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-07-08T22:15:11.643",
  "references": [
    {
      "url": "http://www.mailenable.com/Premium-ReleaseNotes.txt",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mailenable.com/Premium-ReleaseNotes.txt",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "MailEnable Enterprise Premium 10.23 was vulnerable to multiple directory traversal issues, with which authenticated users could add, remove, or potentially read files in arbitrary folders accessible by the IIS user. This could lead to reading other users' credentials including those of SYSADMIN accounts, reading other users' emails, or adding emails or files to other users' accounts."
    },
    {
      "lang": "es",
      "value": "MailEnable Enterprise Premium versión 10.23, fue vulnerable a múltiples problemas de salto de directorio, con lo cual los usuarios identificados  podrían agregar, eliminar o potencialmente leer archivos en carpetas arbitrarias accesibles mediante el usuario IIS. Esto podría conllevar a leer las credenciales de otros usuarios, incluyendo las de las cuentas de SYSADMIN, leer los correos electrónicos de otros usuarios o agregar correos electrónicos o archivos en las cuentas de otros usuarios."
    }
  ],
  "lastModified": "2026-06-17T02:15:44.043",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mailenable:mailenable:*:*:*:*:premium:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7B4998A-BD40-4D0D-AC78-0457F40067C0",
              "versionEndExcluding": "6.90",
              "versionStartIncluding": "6.0"
            },
            {
              "criteria": "cpe:2.3:a:mailenable:mailenable:*:*:*:*:premium:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B9FFD5C-6982-4B54-BED3-DBAF30490439",
              "versionEndExcluding": "7.62",
              "versionStartIncluding": "7.0"
            },
            {
              "criteria": "cpe:2.3:a:mailenable:mailenable:*:*:*:*:premium:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1FAD50A0-D3E4-40B7-80DB-AD741B1BE1E6",
              "versionEndExcluding": "8.64",
              "versionStartIncluding": "8.00"
            },
            {
              "criteria": "cpe:2.3:a:mailenable:mailenable:*:*:*:*:premium:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5DCC3F1A-6A49-4A2B-B973-1A44EFEF675B",
              "versionEndExcluding": "9.83",
              "versionStartIncluding": "9.0"
            },
            {
              "criteria": "cpe:2.3:a:mailenable:mailenable:*:*:*:*:premium:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55F2A0A6-2BA0-4176-B9A2-9E2A86635BC2",
              "versionEndExcluding": "10.24",
              "versionStartIncluding": "10.00"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}