« Volver al listado

CVE-2019-12926

Estado: ModificadaAlta (8.8)—

MailEnable Enterprise Premium versión 10.23, no usó una comprobación del control de acceso apropiada en varias áreas. Como resultado, fue posible realizar una serie de acciones, cuando se inicia sesión como usuario, que este usuario no tuviera permiso para realizarlas. También fue posible conseguir acceso a las áreas dentro de la aplicación para las cuales se suponía que las cuentas utilizadas tenían acceso insuficiente.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mailenable — Mailenable

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-12926",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-07-08T22:15:11.737",
  "references": [
    {
      "url": "http://www.mailenable.com/Premium-ReleaseNotes.txt",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mailenable.com/Premium-ReleaseNotes.txt",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. As a result, it was possible to perform a number of actions, when logged in as a user, that that user should not have had permission to perform. It was also possible to gain access to areas within the application for which the accounts used were supposed to have insufficient access."
    },
    {
      "lang": "es",
      "value": "MailEnable Enterprise Premium versión 10.23, no usó una comprobación del control de acceso apropiada en varias áreas. Como resultado, fue posible realizar una serie de acciones, cuando se inicia sesión como usuario, que este usuario no tuviera permiso para realizarlas. También fue posible conseguir acceso a las áreas dentro de la aplicación para las cuales se suponía que las cuentas utilizadas tenían acceso insuficiente."
    }
  ],
  "lastModified": "2026-06-17T02:15:44.183",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mailenable:mailenable:*:*:*:*:premium:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7B4998A-BD40-4D0D-AC78-0457F40067C0",
              "versionEndExcluding": "6.90",
              "versionStartIncluding": "6.0"
            },
            {
              "criteria": "cpe:2.3:a:mailenable:mailenable:*:*:*:*:premium:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B9FFD5C-6982-4B54-BED3-DBAF30490439",
              "versionEndExcluding": "7.62",
              "versionStartIncluding": "7.0"
            },
            {
              "criteria": "cpe:2.3:a:mailenable:mailenable:*:*:*:*:premium:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1FAD50A0-D3E4-40B7-80DB-AD741B1BE1E6",
              "versionEndExcluding": "8.64",
              "versionStartIncluding": "8.00"
            },
            {
              "criteria": "cpe:2.3:a:mailenable:mailenable:*:*:*:*:premium:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5DCC3F1A-6A49-4A2B-B973-1A44EFEF675B",
              "versionEndExcluding": "9.83",
              "versionStartIncluding": "9.0"
            },
            {
              "criteria": "cpe:2.3:a:mailenable:mailenable:*:*:*:*:premium:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55F2A0A6-2BA0-4176-B9A2-9E2A86635BC2",
              "versionEndExcluding": "10.24",
              "versionStartIncluding": "10.00"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}