by Kastro
Paper/Archive/CVE-2023-23566

CVE-2023-23566

mitre — A 2-Step Verification problem in Axigen 10.3.3.52 allows an attacker to access a mailbox by bypassing 2-Step Verification when they try t…

EPSS 1.0%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 62.6.626 × 2012.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A 2-Step Verification problem in Axigen 10.3.3.52 allows an attacker to access a mailbox by bypassing 2-Step Verification when they try to add an account to any third-party webmail service (or add an account to Outlook or Gmail, etc.) with IMAP or POP3 without any verification code.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/umz-cert/vulnerabilities/issues/1refgithub.com/umz-cert/vulnerabilitys/blob/patch-1/Axigen%20Mail%20Server%2010.3.3.52%202-Step%20verificationrefaxigen.com/mail-server/downloadrefaxigen.com/documentation/2-step-verification-two-factor-authentication-for-webmail-p69140479