SEPPmail Secure Email Gateway (SEG) vulnerabilities
6 known vulnerabilities in SEPPmail Secure Email Gateway (SEG) from SeppMail. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.7 High severity
SEPPmail Secure Email Gateway (SEG): Uncontrolled Resource Consumption
SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without an absolute request-size limit. An unauthenticated remote attacker can occupy workers and consume temporary storage with
- 9.2 Critical severity
SEPPmail Secure Email Gateway (SEG): External Control of File Name or Path
SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular fil
- 9.2 Critical severity
SEPPmail Secure Email Gateway (SEG): Improper Neutralization of Directives in Dynamically Evaluated Code
SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or recipient replacement rules. An unauthenticated remote sender can execute operating-system commands in the mail-processing worker context wh
- 8.3 High severity
SEPPmail Secure Email Gateway (SEG): Weak Password Recovery Mechanism for Forgotten Password
SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a
- 8.6 High severity
SEPPmail Secure Email Gateway (SEG): Improper Neutralization of Special Elements used in an OS Command
SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged API token can execute arbitrary commands with "nobody" privileges.
- 7.7 High severity
SEPPmail Secure Email Gateway (SEG): Improper Authentication
SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access protected functionality with