VulnerabilityModified
CVE-2022-42136
That action, could lead an attacker to store arbitrary code on that files and execute RCE commands.
HIGH 8.8EPSS 0.87%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.87%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Authenticated mail users, under specific circumstances, could add files with unsanitized content in public folders where the IIS user had permission to access. That action, could lead an attacker to store arbitrary code on that files and execute RCE commands.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.87% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- mailenable/mailenable
- Source
- cve@mitre.org
References
- https://pastebin.com/ahLNMf5nThird Party Advisory
- https://www.mailenable.com/kb/content/article.asp?ID=ME020737Vendor Advisory
- https://pastebin.com/ahLNMf5nThird Party Advisory
- https://www.mailenable.com/kb/content/article.asp?ID=ME020737Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.