CVE-2019-7214

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/160416/SmarterMail-6985-Remote-Code-Execution.html
http://packetstormsecurity.com/files/173388/SmarterTools-SmarterMail-Remote-Code-Execution.html
https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-smartermail/Third Party Advisory
https://www.smartertools.com/smartermail/release-notes/currentExploit, Release Notes, Vendor Advisory
http://packetstormsecurity.com/files/160416/SmarterMail-6985-Remote-Code-Execution.html
http://packetstormsecurity.com/files/173388/SmarterTools-SmarterMail-Remote-Code-Execution.html
https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-smartermail/Third Party Advisory
https://www.smartertools.com/smartermail/release-notes/currentExploit, Release Notes, Vendor Advisory

Timeline

Published: Apr 24, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-72156.5Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but CVE-2019-72167.8An issue was discovered in FileChucker 4.99e-free-e02. filechucker.cgi has a filter bypass that allows a malicious user to upload any type o CVE-2019-72177.5Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses CVE-2019-72185.9Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the CVE-2019-72196.1Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. NOTE: this is a discontinued product. CVE-2019-72206.1X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter.CVE-2019-72217.8The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.CVE-2019-72225.5The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.CVE-2019-72235.4InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field to the "Create CVE-2019-72258.8The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. These cred CVE-2019-72268.8The ABB IDAL HTTP server CGI interface contains a URL that allows an unauthenticated attacker to bypass authentication and gain access to pr CVE-2019-72277.3In the ABB IDAL FTP server, an authenticated attacker can traverse to arbitrary directories on the hard disk with "CWD ../" and then use the