Threats tagged 'ghsa-qhw2-rfvc-fvrq'

SmarterTools SmarterMail builds prior to 9560 have a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint. This flaw allows authenticated users to read arbitrary .json files on the system. Exploitation combined with weak encryption and hardcoded keys can expose stored passwords and 2FA secrets for all users. The vulnerability has a high severity with a CVSS score of 8.1.