CVE-2022-42136
Last modified
CVE-2022-42136 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Authenticated mail users, under specific circumstances, could add files with unsanitized content in public folders where the IIS user had permission to access. That action, could lead an attacker to store arbitrary code on that files and execute RCE commands.. EPSS estimates a 0.87% chance of exploitation in the next 30 days.
Description
Authenticated mail users, under specific circumstances, could add files with unsanitized content in public folders where the IIS user had permission to access. That action, could lead an attacker to store arbitrary code on that files and execute RCE commands.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mailenable | Mailenable | < 8.66 |
| Mailenable | Mailenable | >= 9.0, < 9.85 |
| Mailenable | Mailenable | >= 10.00, < 10.42 |
References
- https://pastebin.com/ahLNMf5nThird Party Advisory
- https://pastebin.com/ahLNMf5nThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-42136?
How severe is CVE-2022-42136?
How do I fix CVE-2022-42136?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-42128The Hypermedia REST APIs module in Liferay Portal 7.4.1 thro…5.3
- CVE-2022-42129An Insecure direct object reference (IDOR) vulnerability in …4.3
- CVE-2022-4213The Chained Quiz plugin for WordPress is vulnerable to Refle…6.1
- CVE-2022-42130The Dynamic Data Mapping module in Liferay Portal 7.1.0 thro…4.3
- CVE-2022-42131Certain Liferay products are affected by: Missing SSL Certif…4.8
- CVE-2022-42132The Test LDAP Users functionality in Liferay Portal 7.0.0 th…5.9
- CVE-2022-42139Delta Electronics DVW-W02W2-E2 1.5.0.10 is vulnerable to Com…8.8
- CVE-2022-4214The Chained Quiz plugin for WordPress is vulnerable to Refle…6.1
- CVE-2022-42140Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Comman…7.2
- CVE-2022-42141Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Cross …5.4
- CVE-2022-42142Online Tours & Travels Management System v1.0 is vulnerable …7.2
- CVE-2022-42143Open Source SACCO Management System v1.0 is vulnerable to SQ…7.2
Are you affected by CVE-2022-42136?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST