CVE-2023-23566

Katalog CVE

CVSS 9.8 · Critical EPSS 0,95%

Kerentanan Incorrect Default Permissions pada axigen mail server. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A 2-Step Verification problem in Axigen 10.3.3.52 allows an attacker to access a mailbox by bypassing 2-Step Verification when they try to add an account to any third-party webmail service (or add an account to Outlook or Gmail, etc.) with IMAP or POP3 without any verification code.

Rincian

Terbit di NVD

13 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-276: Incorrect Default Permissions

EPSS (30 hari)

0,95% peluang dieksploitasi; lebih tinggi dari 60,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.axigen.com/documentation/2-step-verification-two-factor-authentication-for-webmail-p69140479 deskripsi teknis · advisory vendor
• https://www.axigen.com/mail-server/download/ advisory vendor
• https://github.com/umz-cert/vulnerabilities/issues/1 advisory pihak ketiga
• https://github.com/umz-cert/vulnerabilitys/blob/patch-1/Axigen%20Mail%20Server%2010.3.3.52%202-Step%20verifica... advisory pihak ketiga