Cleartext Credential Storage Vulnerability in MailEnable
CVE-2025-34428
6.8MEDIUM
What is CVE-2025-34428?
MailEnable versions before 10.54 are susceptible to a vulnerability that results in the insecure storage of user and administrative credentials in plaintext format. The AUTH.SAV file, which holds these credentials, has excessive filesystem permissions that allow local authenticated users to access its contents. This exposure enables an attacker to recover all user passwords and super-admin credentials. If exploited, these credentials can facilitate unauthorized access to MailEnable services including POP3, SMTP, and webmail, leading to potential mailbox access and administrative control for malicious actors.
Affected Version(s)
MailEnable 0 < 10.54
References
CVSS V4
Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
MushroomSecTeam (Spotify, AmirSUN, M30Brad, Hannah Green, av01t3x, PG)