CVE-2018-7702 Missing authorization in n/a
Remote attackers can spoof emails, resend messages, or modify content due to missing authentication and authorization checks in SecurMail.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-7702?
CVE-2018-7702 is a critical missing authorization vulnerability in n/a, published on 14 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of arbitrary e-mail messages, resend e-mail messages to arbitrary recipients, or modify arbitrary message bodies and attachments by leveraging missing authentication and authorization.
Weakness: CWE-862
Which versions are affected by CVE-2018-7702?
It affects 1 product.
Products include Securenvoy Securmail.
How do I fix CVE-2018-7702?
No fix has been published for CVE-2018-7702 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-7702 being exploited?
There is no known exploitation of CVE-2018-7702 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
- CVE-2020-13376 File upload in n/a
- CVE-2018-7705 Path traversal in n/a
- CVE-2018-7701 Multiple cross-site request forgery (CSRF) vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authe
- CVE-2018-7704 Information disclosure in n/a
- CVE-2018-7706 Path traversal in n/a
Sources
Also known as GHSA-8mxj-8qfg-pg7x.