Cleartext Credential Storage Vulnerability in MailEnable
CVE-2025-34427
6.8MEDIUM
What is CVE-2025-34427?
MailEnable versions prior to 10.54 are susceptible to a vulnerability that involves the storage of user and administrative credentials in plaintext format within the AUTH.TAB file. This misconfiguration allows local authenticated users with read access to gain unauthorized access to user passwords and super-admin credentials. Consequently, these credentials can be exploited to access MailEnable services such as POP3, SMTP, and the webmail interface, resulting in potential account takeover and unauthorized administrative control over mailboxes.
Affected Version(s)
MailEnable 0 < 10.54
References
CVSS V4
Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
MushroomSecTeam (Spotify, AmirSUN, M30Brad, Hannah Green, av01t3x, PG)