CVE-2025-34427: falha de alta gravidade em MailEnable
MailEnable < 10.54 Cleartext Credential Storage in AUTH.TAB
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.4epss 0.1%
MailEnable versions prior to 10.54 contain a cleartext storage of credentials vulnerability that can lead to local credential compromise and account takeover. The product stores user and administrative passwords in plaintext within AUTH.TAB with overly permissive filesystem access. A local authenticated user with read access to this file can recover all user passwords and super-admin credentials, then use them to authenticate to MailEnable services such as POP3, SMTP, or the webmail interface, enabling unauthorized mailbox access and administrative control.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
MailEnable · MailEnableCVEs relacionadas — MailEnable
No mesmo produto, das mais perigosas para as menos.
CVE-2025-34408MEDIUMMailEnable < 10.54 Reflected XSS in Added Parameter of MAI/AddRecipientsResult.aspxEPSS 0.5%CVE-2025-34409MEDIUMMailEnable < 10.54 Reflected XSS in Failed Parameter of MAI/AddRecipientsResult.aspxEPSS 0.5%CVE-2025-34407MEDIUMMailEnable < 10.54 Reflected XSS in theme Parameter of Statistics.aspxEPSS 0.5%CVE-2026-114552MEDIUMMailEnable parseObjectResponse XML External Entity Processing Information Disclosure VulnerabilityEPSS 0.5%CVE-2025-34425MEDIUMMailEnable < 10.54 Reflected XSS in WindowContext Parameter of MAI/compose.aspxEPSS 0.4%CVE-2025-34398MEDIUMMailEnable < 10.54 Reflected XSS in AddressesBcc Parameter of AddressBook.aspxEPSS 0.4%