It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade evolution-data-server-develUpgrade evolution-data-serverUpgrade evolution-data-server-perlUpgrade evolution-data-server-langpacksUpgrade evolution-ewsUpgrade evolution-data-server-debuginfoUpgrade evolution-ews-debuginfoUpgrade evolution-data-server-testsUpgrade evolution-data-server-docUpgrade evolution-ews-langpacks | Aug 25, 2020 | Aug 1, 2019 |
| Centos_linux | — | Upgrade evolution-debuginfoUpgrade evolution-data-server-testsUpgrade evolution-data-server-debugsourceUpgrade evolution-ews-langpacksUpgrade evolution-ews-debuginfoUpgrade evolution-pst-debuginfoUpgrade evolution-spamassassin-debuginfoUpgrade evolution-pstUpgrade evolution-ews-debugsourceUpgrade evolution-bogofilter-debuginfoUpgrade evolution-data-server-docUpgrade evolution-devel-docsUpgrade evolutionUpgrade evolution-langpacksUpgrade evolution-debugsourceUpgrade evolution-data-serverUpgrade evolution-bogofilterUpgrade evolution-helpUpgrade evolution-data-server-langpacksUpgrade evolution-data-server-perlUpgrade evolution-spamassassinUpgrade evolution-ewsUpgrade evolution-data-server-debuginfoUpgrade evolution-data-server-develUpgrade evolution-data-server-tests-debuginfoUpgrade evolution-devel | Nov 6, 2019 | Aug 1, 2019 |
| Debian | — | Upgrade evolution-ews | Jul 30, 2024 | Aug 1, 2019 |
| Oracle_linux | — | Upgrade evolution-pstUpgrade evolution-data-server-testsUpgrade evolution-langpacksUpgrade atk-develUpgrade evolution-ewsUpgrade evolution-devel-docsUpgrade evolution-bogofilterUpgrade evolution-data-server-develUpgrade evolution-ews-langpacksUpgrade evolution-data-server-docUpgrade evolutionUpgrade evolution-data-serverUpgrade evolution-develUpgrade evolution-data-server-perlUpgrade evolution-helpUpgrade atkUpgrade evolution-data-server-langpacksUpgrade evolution-spamassassin | Nov 22, 2019 | Feb 15, 2019 |
| Redhat_linux | — | Upgrade evolution-debugsourceUpgrade evolution-data-server-develUpgrade atk-develUpgrade evolution-data-server-debuginfoUpgrade evolution-langpacksUpgrade evolutionUpgrade evolution-data-server-tests-debuginfoUpgrade evolution-bogofilterUpgrade evolution-data-serverUpgrade evolution-data-server-langpacksUpgrade evolution-spamassassinUpgrade evolution-ewsUpgrade evolution-helpUpgrade evolution-data-server-perlUpgrade evolution-ews-langpacksUpgrade evolution-pst-debuginfoUpgrade atkUpgrade evolution-ews-debugsourceUpgrade evolution-ews-debuginfoUpgrade evolution-develUpgrade evolution-devel-docsUpgrade evolution-debuginfoUpgrade evolution-pstUpgrade atk-debuginfoUpgrade evolution-bogofilter-debuginfoUpgrade evolution-data-server-testsUpgrade evolution-data-server-docUpgrade evolution-spamassassin-debuginfoUpgrade evolution-data-server-debugsource | Nov 6, 2019 | Aug 1, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub