IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
6.1Orta KEV

CVE-2025-59689Libraesva Email Security Gateway Command Injection Vulnerability

Libraesva Email Security Gateway Yayım: (1 yıl önce)

Aktif olarak istismar ediliyor — Libraesva Email Security Gateway Command Injection Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 29.09.2025 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 20.10.2025.

Gerekli işlem: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://docs.libraesva.com/knowledgebase/security-advisory-command-injection-vulnerability-cve-2025-59689/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-59689

Açıklama

Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been released in 5.5.7.

Zayıflık türü (CWE): CWE-77

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
Libraesva Email Security Gateway 4.5 – < 5.0.31, 5.1 – < 5.1.20, 5.2 – < 5.2.31, 5.3 – < 5.4.8, 5.5 – < 5.5.7

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (6)
  • cpe:2.3:a:libraesva:email_security_gateway:*:*:*:*:*:*:*:* ≥ 4.5 < 5.0.31
  • cpe:2.3:a:libraesva:email_security_gateway:*:*:*:*:*:*:*:* ≥ 5.1.0 < 5.1.20
  • cpe:2.3:a:libraesva:email_security_gateway:*:*:*:*:*:*:*:* ≥ 5.2.0 < 5.2.31
  • cpe:2.3:a:libraesva:email_security_gateway:*:*:*:*:*:*:*:* ≥ 5.3.0 < 5.3.16
  • cpe:2.3:a:libraesva:email_security_gateway:*:*:*:*:*:*:*:* ≥ 5.4.0 < 5.4.8
  • cpe:2.3:a:libraesva:email_security_gateway:*:*:*:*:*:*:*:* ≥ 5.5.0 < 5.5.7