Advisories

SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API

Go Back
severity
critical
date
Affecting
  • SmarterMail < 100.0.9511

CWE
  • CWE-288 Authentication Bypass Using an Alternate Path or Channel
CVSS
9.3
CVSS V4 Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Credit
Piotr Bazydlo & Sina Kheirkhah of watchTowr
Description
SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.