critical9.8Public exploit code
CVE-2019-7214
SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SmarterMail Build 6985 - Remote Code Execution2020-12-09 · remote · windows
Impact
SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Smartertools | Smartermail | from 16.0.6345 before 16.3.6985 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/160416/SmarterMail-6985-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/173388/SmarterTools-SmarterMail-Remote-Code-Execution.html
- https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-smartermail/
- https://www.smartertools.com/smartermail/release-notes/current
- http://packetstormsecurity.com/files/160416/SmarterMail-6985-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/173388/SmarterTools-SmarterMail-Remote-Code-Execution.html
- https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-smartermail/
- https://www.smartertools.com/smartermail/release-notes/current