It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade evolution-data-server-testsUpgrade evolution-ews-debuginfoUpgrade evolution-ews-langpacksUpgrade evolution-data-server-docUpgrade evolution-data-serverUpgrade evolution-ewsUpgrade evolution-data-server-debuginfoUpgrade evolution-data-server-develUpgrade evolution-data-server-perlUpgrade evolution-data-server-langpacks | Aug 25, 2020 | Aug 1, 2019 |
| Centos_linux | — | Upgrade evolution-data-server-langpacksUpgrade evolution-bogofilterUpgrade evolution-devel-docsUpgrade evolution-data-serverUpgrade evolutionUpgrade evolution-ewsUpgrade evolution-debugsourceUpgrade evolution-data-server-perlUpgrade evolution-develUpgrade evolution-data-server-tests-debuginfoUpgrade evolution-helpUpgrade evolution-langpacksUpgrade evolution-spamassassinUpgrade evolution-data-server-debuginfoUpgrade evolution-data-server-develUpgrade evolution-pst-debuginfoUpgrade evolution-debuginfoUpgrade evolution-data-server-docUpgrade evolution-pstUpgrade evolution-ews-debugsourceUpgrade evolution-data-server-debugsourceUpgrade evolution-ews-langpacksUpgrade evolution-data-server-testsUpgrade evolution-bogofilter-debuginfoUpgrade evolution-spamassassin-debuginfoUpgrade evolution-ews-debuginfo | Nov 6, 2019 | Aug 1, 2019 |
| Debian | — | Upgrade evolution-ews | Jul 30, 2024 | Aug 1, 2019 |
| Oracle_linux | — | Upgrade evolution-bogofilterUpgrade evolution-langpacksUpgrade evolution-data-server-testsUpgrade atk-develUpgrade evolution-ewsUpgrade evolution-pstUpgrade evolution-devel-docsUpgrade evolution-data-server-perlUpgrade evolution-ews-langpacksUpgrade evolution-spamassassinUpgrade evolution-data-server-langpacksUpgrade evolution-data-server-develUpgrade evolutionUpgrade atkUpgrade evolution-data-server-docUpgrade evolution-develUpgrade evolution-data-serverUpgrade evolution-help | Nov 22, 2019 | Feb 15, 2019 |
| Redhat_linux | — | Upgrade evolution-ewsUpgrade atk-develUpgrade evolution-data-serverUpgrade evolution-bogofilterUpgrade evolution-debugsourceUpgrade evolution-data-server-perlUpgrade evolution-data-server-langpacksUpgrade evolution-data-server-tests-debuginfoUpgrade evolution-helpUpgrade evolution-spamassassinUpgrade evolution-data-server-develUpgrade evolution-data-server-debuginfoUpgrade evolutionUpgrade evolution-langpacksUpgrade evolution-data-server-docUpgrade evolution-debuginfoUpgrade evolution-pstUpgrade evolution-data-server-debugsourceUpgrade evolution-develUpgrade evolution-bogofilter-debuginfoUpgrade evolution-ews-debugsourceUpgrade atkUpgrade evolution-devel-docsUpgrade evolution-data-server-testsUpgrade evolution-ews-langpacksUpgrade evolution-ews-debuginfoUpgrade evolution-pst-debuginfoUpgrade evolution-spamassassin-debuginfoUpgrade atk-debuginfo | Nov 6, 2019 | Aug 1, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub