Vulnerabilities > CVE-2019-7214 - Deserialization of Untrusted Data vulnerability in Smartertools Smartermail

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

smartertools

CWE-502

critical

NVD

Published: 2019-04-24

Updated: 2023-07-11

Summary

SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch.

Vulnerable Configurations

Part	Description	Count
Application	Smartertools Smartertools Smartermail 16.0.6345 Smartertools Smartermail 16.0.6348 Smartertools Smartermail 16.0.6362 Smartertools Smartermail 16.0.6369 Smartertools Smartermail 16.0.6376 Smartertools Smartermail 16.0.6382 Smartertools Smartermail 16.0.6390 Smartertools Smartermail 16.0.6397 Smartertools Smartermail 16.3.6663 Smartertools Smartermail 16.3.6670 Smartertools Smartermail 16.3.6677 Smartertools Smartermail 16.3.6684 Smartertools Smartermail 16.3.6691 Smartertools Smartermail 16.3.6698 Smartertools Smartermail 16.3.6705 Smartertools Smartermail 16.3.6729 Smartertools Smartermail 16.3.6733 Smartertools Smartermail 16.3.6740 Smartertools Smartermail 16.3.6744 Smartertools Smartermail 16.3.6751 Smartertools Smartermail 16.3.6754 Smartertools Smartermail 16.3.6768 Smartertools Smartermail 16.3.6775 Smartertools Smartermail 16.3.6782 Smartertools Smartermail 16.3.6795 Smartertools Smartermail 16.3.6799 Smartertools Smartermail 16.3.6802 Smartertools Smartermail 16.3.6809 Smartertools Smartermail 16.3.6816 Smartertools Smartermail 16.3.6821 Smartertools Smartermail 16.3.6830 Smartertools Smartermail 16.3.6841 Smartertools Smartermail 16.3.6843 Smartertools Smartermail 16.3.6855 Smartertools Smartermail 16.3.6870 Smartertools Smartermail 16.3.6885 Smartertools Smartermail 16.3.6893 Smartertools Smartermail 16.3.6897 Smartertools Smartermail 16.3.6915 Smartertools Smartermail 16.3.6970	40

Common Weakness Enumeration (CWE)

CWE-502 - Deserialization of Untrusted Data

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References