Deserialization in Smartertools Smartermail
CVE-2019-7214
SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch.
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.848 (99.7th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 100th percentile — 99.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.848 · newest: 0.848 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.smartertools.com/smartermail/release-notes/current (Exploit, Release Notes, Vendor Advisory)
- www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-… (Third Party Advisory)
- packetstormsecurity.com/files/160416/SmarterMail-6985-Remote-Code-Execution.html
- packetstormsecurity.com/files/173388/SmarterTools-SmarterMail-Remote-Code-Execu…
Frequently asked questions
- What is CVE-2019-7214?
- CVE-2019-7214 is a critical-severity vulnerability in Smartertools Smartermail, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2019-04-24.
- How severe is CVE-2019-7214?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2019-7214 known to be exploited?
- 15 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.