It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade evolution-data-server-testsUpgrade evolution-ews-langpacksUpgrade evolution-data-server-docUpgrade evolution-ews-debuginfoUpgrade evolution-data-server-perlUpgrade evolution-data-serverUpgrade evolution-data-server-develUpgrade evolution-data-server-debuginfoUpgrade evolution-ewsUpgrade evolution-data-server-langpacks | Aug 25, 2020 | Aug 1, 2019 |
| Centos_linux | — | Upgrade evolution-data-server-testsUpgrade evolution-debuginfoUpgrade evolution-spamassassin-debuginfoUpgrade evolution-data-server-debugsourceUpgrade evolution-bogofilter-debuginfoUpgrade evolution-ews-debuginfoUpgrade evolution-pst-debuginfoUpgrade evolution-pstUpgrade evolution-ews-debugsourceUpgrade evolution-ews-langpacksUpgrade evolution-data-server-docUpgrade evolutionUpgrade evolution-data-serverUpgrade evolution-data-server-langpacksUpgrade evolution-bogofilterUpgrade evolution-data-server-tests-debuginfoUpgrade evolution-langpacksUpgrade evolution-data-server-perlUpgrade evolution-devel-docsUpgrade evolution-spamassassinUpgrade evolution-debugsourceUpgrade evolution-data-server-develUpgrade evolution-data-server-debuginfoUpgrade evolution-ewsUpgrade evolution-helpUpgrade evolution-devel | Nov 6, 2019 | Aug 1, 2019 |
| Debian | — | Upgrade evolution-ews | Jul 30, 2024 | Aug 1, 2019 |
| Oracle_linux | — | Upgrade evolution-ewsUpgrade evolution-pstUpgrade evolution-devel-docsUpgrade evolution-data-server-testsUpgrade evolution-langpacksUpgrade evolution-bogofilterUpgrade atk-develUpgrade evolutionUpgrade evolution-data-server-develUpgrade evolution-spamassassinUpgrade evolution-develUpgrade evolution-data-server-perlUpgrade evolution-data-serverUpgrade evolution-data-server-langpacksUpgrade evolution-data-server-docUpgrade evolution-ews-langpacksUpgrade atkUpgrade evolution-help | Nov 22, 2019 | Feb 15, 2019 |
| Redhat_linux | — | Upgrade evolution-devel-docsUpgrade atkUpgrade evolution-bogofilter-debuginfoUpgrade evolution-ews-langpacksUpgrade evolution-spamassassin-debuginfoUpgrade evolution-pstUpgrade atk-debuginfoUpgrade evolution-debuginfoUpgrade evolution-data-server-debugsourceUpgrade evolution-ews-debugsourceUpgrade evolution-develUpgrade evolution-pst-debuginfoUpgrade evolution-data-server-docUpgrade evolution-ews-debuginfoUpgrade evolution-data-server-testsUpgrade evolution-data-server-develUpgrade evolution-data-server-perlUpgrade evolution-langpacksUpgrade evolution-data-server-tests-debuginfoUpgrade evolution-bogofilterUpgrade evolution-debugsourceUpgrade evolution-data-serverUpgrade evolution-ewsUpgrade evolution-spamassassinUpgrade evolution-data-server-debuginfoUpgrade atk-develUpgrade evolution-helpUpgrade evolutionUpgrade evolution-data-server-langpacks | Nov 6, 2019 | Aug 1, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub