Описание
Use of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other servers from hMailAdmin.exe.config file to access other hMailServer admin consoles with configured connections.
Ссылки
- Product
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:hmailserver:hmailserver:5.6.9:beta:*:*:*:*:*:*
cpe:2.3:a:hmailserver:hmailserver:5.8.6:*:*:*:*:*:*:*
EPSS
Процентиль: 4%
0.00019
Низкий
4.6 Medium
CVSS3
Дефекты
CWE-321
Связанные уязвимости
CVSS3: 4.6
github
7 месяцев назад
Use of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other servers from hMailAdmin.exe.config file to access other hMailServer admin consoles with configured connections.
EPSS
Процентиль: 4%
0.00019
Низкий
4.6 Medium
CVSS3
Дефекты
CWE-321