CVE-2019-7214
First published: Wed Apr 24 2019(Updated: )
SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SmarterTools SmarterMail | >=16.0.6345<16.3.6985 | |
| >=16.0.6345<16.3.6985 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/160416/SmarterMail-6985-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/173388/SmarterTools-SmarterMail-Remote-Code-Execution.html
- https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-smartermail/
- https://www.smartertools.com/smartermail/release-notes/current
Frequently Asked Questions
What is CVE-2019-7214?
CVE-2019-7214 is a vulnerability in SmarterTools SmarterMail 16.x before build 6985 that allows deserialization of untrusted data, which can lead to remote code execution.
How severe is CVE-2019-7214?
CVE-2019-7214 has a severity score of 9.8, which is considered critical.
What is the affected software version of CVE-2019-7214?
CVE-2019-7214 affects SmarterTools SmarterMail versions between 16.0.6345 and 16.3.6985.
How can an attacker exploit CVE-2019-7214?
An unauthenticated attacker can exploit CVE-2019-7214 by running commands on the server when port 17001 is remotely accessible.
How can CVE-2019-7214 be mitigated?
To mitigate CVE-2019-7214, apply the Build 6985 patch, which makes port 17001 not accessible remotely by default.
- collector/nvd-index
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/smartertools
- canonical/smartertools smartermail
- version/smartertools smartermail/16.0.6345