Description (CNA)
In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery (CSRF) protection mechanism was not implemented correctly and it was possible to bypass it by removing the anti-CSRF token parameter from the request. This could allow an attacker to manipulate a user into unwittingly performing actions within the application (such as sending email, adding contacts, or changing settings) on behalf of the attacker.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- http://www.mailenable.com/Premium-ReleaseNotes.txt
- https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-mailenable/
ADP enrichment
No English description supplied.