Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-7704: SecurEnvoy SecurMail lets logged‑in users view any email

CVE-2018-7704 · published 8 years ago

Summary

If someone can log into SecurEnvoy SecurMail, they can use a specific function to open and read any other user's messages. This could expose private communications and confidential information. Apply the vendor's update to version 9.2.501 or later, and ensure only trusted users have login credentials.

What to do

Update securenvoy securmail to version 9.2.501 or later.

Affected software

Vendor	Product	Affected versions
securenvoy	securmail	< 9.2.501 `cpe:2.3:a:securenvoy:securmail::::::::`

Original advisory text

SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1 parameter in a reply action to secmail/getmessage.exe.

References

http://seclists.org/fulldisclosure/2018/Mar/29 Exploit Mailing List Third Party Advisory
https://www.exploit-db.com/exploits/44285/ Exploit Third Party Advisory VDB Entry
https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities... Exploit Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

5% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published15 Mar 2018

Updated30 Oct 2026

First seen29 Sep 2026

Sources

CVE-2018-7704 · NVD

Track software like this

Free during beta