CVE-2019-12924: XEE
MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploited by an unauthenticated user. It was possible for an attacker to use a vulnerability in the configuration of the XML processor to read any file on the host system. Because all credentials were stored in a cleartext file, it was possible to steal all users' credentials (including the highest privileged users).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-12924?
CVE-2019-12924 has a critical severity rating due to its potential to allow unauthorized file access on the host system.
How do I fix CVE-2019-12924?
To fix CVE-2019-12924, upgrade MailEnable Enterprise Premium to a version above 10.24.
Who is affected by CVE-2019-12924?
CVE-2019-12924 affects MailEnable Enterprise Premium versions between 6.0 and 10.24.
What type of vulnerability is CVE-2019-12924?
CVE-2019-12924 is an XML External Entity Injection (XXE) vulnerability.
Can CVE-2019-12924 be exploited remotely?
Yes, CVE-2019-12924 can be exploited by unauthenticated remote users.