CVE-2018-7702

high-risk
Published 2018-03-15

SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of arbitrary e-mail messages, resend e-mail messages to arbitrary recipients, or modify arbitrary message bodies and attachments by leveraging missing authentication and authorization.

Do I need to act?

!
36.9% chance of exploitation in next 30 days
EPSS score — higher than 63% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
44285
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.1/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Securenvoy

References (6)

Mailing List http://seclists.org/fulldisclosure/2018/Mar/29
Third Party Advisory https://www.exploit-db.com/exploits/44285/
Third Party Advisory https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities...
Mailing List http://seclists.org/fulldisclosure/2018/Mar/29
Third Party Advisory https://www.exploit-db.com/exploits/44285/
Third Party Advisory https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities...
52
/ 100
high-risk
Severity 31/34 · Critical
Exploitability 16/34 · Moderate
Exposure 5/34 · Minimal