SEPPmail Secure Email Gateway Email Header Parsing Vulnerability Allowing Source Spoofing and Decryption

A vulnerability in SEPPmail Secure Email Gateway versions prior to 15.0.1 allows for improper interpretation of email addresses in headers. This misinterpretation can conflict with other mail infrastructure, enabling an attacker to spoof the email source or decrypt the message.

Impact

Exploitation of this vulnerability could lead to unauthorized decryption of emails or spoofing of email sources, potentially allowing malicious emails to appear as if they were sent from a trusted source.

Reproduction

The vulnerability can be reproduced by sending an email that includes headers with email addresses. The Secure Email Gateway will incorrectly parse these addresses, creating a conflict that can be exploited to fake the email's source or decrypt its contents.

Remediation

Users can update to SEPPmail Secure Email Gateway version 15.0.1 or later, where this vulnerability has been addressed.