CVE-2019-12923 Cross-site request forgery in n/a
Attackers can bypass CSRF protection in MailEnable Enterprise Premium to force users to perform actions like sending emails or changing settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-12923?
CVE-2019-12923 is a medium-severity vulnerability in Mailenable Mailenable, published on 8 Jul 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery (CSRF) protection mechanism was not implemented correctly and it was possible to bypass it by removing the anti-CSRF token parameter from the request. This could allow an attacker to manipulate a user into unwittingly performing actions within the application (such as sending email, adding contacts, or changing settings) on behalf of the attacker.
Weakness: CWE-352
Which versions are affected by CVE-2019-12923?
It affects 1 product.
Products include Mailenable Mailenable.
How do I fix CVE-2019-12923?
No fix has been published for CVE-2019-12923 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-12923 being exploited?
There is no known exploitation of CVE-2019-12923 in the wild and no public exploit code.
Other vulnerabilities in Mailenable Mailenable
- CVE-2015-9280 XML external entity in n/a
- CVE-2025-44148 Cross-site scripting in n/a
- CVE-2019-12924 XML external entity in n/a
- CVE-2015-9278 MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB a
- CVE-2015-9277 Path traversal in n/a
Sources
Also known as GHSA-2fvq-gwm3-84c2.