Description
A vulnerability classified as problematic was found in b1gMail up to 7.4.1-pl1. Affected by this vulnerability is an unknown functionality of the file src/admin/users.php of the component Admin Page. The manipulation of the argument query/q leads to deserialization. The attack can be launched remotely. Upgrading to version 7.4.1-pl2 is able to address this issue. The identifier of the patch is 4816c8b748f6a5b965c8994e2cf10861bf6e68aa. It is recommended to upgrade the affected component. The vendor acted highly professional and even fixed this issue in the discontinued commercial edition as b1gMail 7.4.0-pl3.
References (7)
Core 7
Core References
Permissions Required, VDB Entry vdb-entry
technical-description
https://vuldb.com/?id.297829
Permissions Required, VDB Entry signature
permissions-required
https://vuldb.com/?ctiid.297829
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.505838
Various Sources related
https://gist.github.com/mcdruid/cb0b848c12fd6a6bc0c1b3357b983d30
Various Sources patch
https://www.b1gmail.eu/forum/thread/217-security-update-to-b1gmail-7-4-1-released/
Release Notes patch
https://github.com/b1gMail-OSS/b1gMail/releases/tag/7.4.1-pl2
Scores
CVSS v3
4.7
EPSS
0.0022
EPSS Percentile
44.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-20
CWE-502
Status
published
Products (1)
n/a/b1gMail
7.4.1-pl1
Published
Feb 27, 2025
Tracked Since
Feb 18, 2026