MailEnable Professional up to 1.77 cleartext storage

Summaryinfo

A vulnerability classified as problematic has been found in MailEnable Professional up to 1.77. This affects an unknown part. This manipulation causes cleartext storage. This vulnerability appears as CVE-2006-6964. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in MailEnable Professional up to 1.77 (Mail Server Software) and classified as problematic. Affected by this vulnerability is some unknown processing. The manipulation with an unknown input leads to a cleartext storage vulnerability. The CWE definition for the vulnerability is CWE-312. The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. As an impact it is known to affect confidentiality. The summary by CVE is:

MailEnable Professional before 1.78 provides a cleartext user password when an administrator edits the user s settings, which allows remote authenticated administrators to obtain sensitive information by viewing the HTML source.

The weakness was presented 01/29/2007 (Website). It is possible to read the advisory at securitytracker.com. This vulnerability is known as CVE-2006-6964 since 01/29/2007. The exploitation appears to be easy. The attack can be launched remotely. Required for exploitation is a single authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1555 according to MITRE ATT&CK.

Upgrading to version 1.78 eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (27185) and SecurityTracker (ID 1016337†). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Mail Server Software

Name

• MailEnable Professional

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39
• 1.40
• 1.41
• 1.42
• 1.43
• 1.44
• 1.45
• 1.46
• 1.47
• 1.48
• 1.49
• 1.50
• 1.51
• 1.52
• 1.53
• 1.54
• 1.55
• 1.56
• 1.57
• 1.58
• 1.59
• 1.60
• 1.61
• 1.62
• 1.63
• 1.64
• 1.65
• 1.66
• 1.67
• 1.68
• 1.69
• 1.70
• 1.71
• 1.72
• 1.73
• 1.74
• 1.75
• 1.76
• 1.77

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion