Deserialization in Smartertools Smartermail
CVE-2019-7214
SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default…
Vulnerability class: Insecure Deserialization
EPSS: 0.848 (99.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Smartertools Smartermail
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, Release Notes, Vendor Advisory)
- cve@mitre.org (Third Party Advisory)
- cve@mitre.org
- cve@mitre.org
Frequently asked questions
- What is CVE-2019-7214?
- CVE-2019-7214 is a critical-severity vulnerability in Smartertools Smartermail, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2019-04-24.
- How severe is CVE-2019-7214?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2019-7214 known to be exploited?
- 15 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.