CVE-2025-34490

GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://frycos.github.io/vulns4free/2025/04/28/mailessentials.html	Exploit
https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:gfi:mailessentials:*:*:*:*:*:*:*:*

History

10 May 2025, 00:58

Type	Values Removed	Values Added
First Time		Gfi Gfi mailessentials
References	~~() https://frycos.github.io/vulns4free/2025/04/28/mailessentials.html -~~	() https://frycos.github.io/vulns4free/2025/04/28/mailessentials.html - Exploit
References	~~() https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases -~~	() https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases - Release Notes
CPE		cpe:2.3:a:gfi:mailessentials::::::::

29 Apr 2025, 13:52

Type	Values Removed	Values Added
Summary		(es) Las versiones anteriores a la 21.8 de GFI MailEssentials son vulnerables a un problema de entidad externa XML (XXE). Un atacante remoto autenticado puede enviar solicitudes HTTP manipuladas para leer archivos arbitrarios del sistema.

28 Apr 2025, 19:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-28 19:15

Updated : 2025-05-10 00:58

NVD link : CVE-2025-34490

Mitre link : CVE-2025-34490

CVE.ORG link : CVE-2025-34490

JSON object : View

Products Affected

gfi

mailessentials

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2025-34490", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2025-04-28T19:15:47.050", "references": [{"url": "https://frycos.github.io/vulns4free/2025/04/28/mailessentials.html", "tags": ["Exploit"], "source": "disclosure@vulncheck.com"}, {"url": "https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases", "tags": ["Release Notes"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-611"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files."}, {"lang": "es", "value": "Las versiones anteriores a la 21.8 de GFI MailEssentials son vulnerables a un problema de entidad externa XML (XXE). Un atacante remoto autenticado puede enviar solicitudes HTTP manipuladas para leer archivos arbitrarios del sistema."}], "lastModified": "2025-05-10T00:58:59.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gfi:mailessentials:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF05D573-6502-4902-95CC-59E8F15A38FC", "versionEndExcluding": "21.8"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}