Threats tagged 'ghsa-x255-6rhg-mx7j'

SEPPmail Secure Email Gateway versions before 15.1.1 allow password recovery for created but unregistered GINA accounts with empty initial passwords without proper ownership verification. This flaw enables a remote unauthenticated attacker to reset the password, authenticate as the account, and block the legitimate user from accessing it. The vulnerability has a high severity with a CVSS score of 8.3.