Directory Traversal Vulnerability in SmarterMail by SmarterTools
CVE-2019-7213

6.5MEDIUM

Key Information:

Vendor

Smartertools

Status
Smartermail
Vendor
CVE Published:
24 April 2019

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 13%

What is CVE-2019-7213?

SmarterMail versions prior to build 6985 are susceptible to a directory traversal vulnerability. This flaw allows authenticated users to manipulate files on the mail server, which includes the ability to delete arbitrary files or create files in unauthorized locations. The exploitation of this vulnerability could potentially lead to command execution on the server by placing malicious files within the web directories. Organizations using affected versions of SmarterMail should prioritize applying the necessary updates to mitigate this risk.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2019-7213
Created by secunnix

References

https://www.smartertools.com/smartermail/release-notes/cu...
x_refsource_CONFIRM
https://www.nccgroup.trust/uk/our-research/technical-advi...
x_refsource_MISC

EPSS Score

13% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.