Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2019-12924: MailEnable Enterprise Premium lets strangers read files, steal passwords
CVE-2019-12924 · published 7 years ago
Summary
MailEnable Enterprise Premium version 10.23 lets anyone on the network read any file on the server because of a mis‑configured XML handler. The server also stores all user passwords in a plain‑text file, so an attacker could copy those passwords, including admin accounts. Update to the latest version or apply the vendor’s patch and protect the password file with encryption.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mailenable | mailenable |
>= 6.0, < 6.90 >= 7.0, < 7.62 >= 8.00, < 8.64 >= 9.0, < 9.83 >= 10.00, < 10.24 cpe:2.3:a:mailenable:mailenable:*:*:*:*:premium:*:*:* |
Original advisory text
MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploited by an unauthenticated user. It was possible for an attacker to use a vulner...
MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploited by an unauthenticated user. It was possible for an attacker to use a vulnerability in the configuration of the XML processor to read any file on the host system. Because all credentials were stored in a cleartext file, it was possible to steal all users' credentials (including the highest privileged users).
References
- http://www.mailenable.com/Premium-ReleaseNotes.txt Release Notes Vendor Advisory
- https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabi... Release Notes Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-311Missing Encryption of Sensitive Data
CWE-611XML External Entity (XXE)
Timeline
Published8 Jul 2019
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-12924 · NVD
Track software like this
Free during beta