CVE-2019-7214

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

84.82%

Published

Apr 24, 2019

Modified

Nov 21, 2024

Public PoC / Exploit (2)

All weaponized →

TrickestTrickest PoC index Exploit-DBSmarterMail Build 6985 - Remote Code Execution

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch.

Weaknesses (CWE)

CWE-502

Affected Products (1)

smartertools · smartermail (up to 16.3.6985)vulnerable

References (8)

http://packetstormsecurity.com/files/160416/SmarterMail-6985-Remote-Code-Execution.html

http://packetstormsecurity.com/files/173388/SmarterTools-SmarterMail-Remote-Code-Execution.html

https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-smartermail/

Third Party Advisory

https://www.smartertools.com/smartermail/release-notes/current

ExploitRelease NotesVendor Advisory

http://packetstormsecurity.com/files/160416/SmarterMail-6985-Remote-Code-Execution.html