漏洞详情: CVE-2024-35179

漏洞标题
Unprivileged Stalwart Mail Server user can read files as root
来源:NVD
Stalwart Mail Server 安全漏洞
来源:CNNVD
漏洞描述
Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, when using `RUN_AS_USER`, the specified user (and therefore, web interface admins) can read arbitrary files as root. This issue affects admins who have set up to run stalwart with `RUN_AS_USER` who handed out admin credentials to the mail server but expect these to only grant access according to the `RUN_AS_USER` and are attacked where the attackers managed to achieve Arbitrary Code Execution using another vulnerability. Version 0.8.0 contains a patch for the issue.
来源:NVD
Stalwart Mail Server是Stalwart实验室的一体化邮件服务器。 Stalwart Mail Server 0.8.0 之前版本存在安全漏洞,该漏洞源于当使用 RUN_AS_USER 时,指定用户可以以 root 身份读取任意文件。
来源:CNNVD
None
来源:神龙机器人
漏洞评分(CVSS)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
来源:NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
来源:神龙机器人, 准确率:7/8 = 87.50%
漏洞类别
特权放弃/降低错误
来源:NVD
其他
来源:CNNVD
相关链接