SEPPmail Secure Email Gateway Unauthenticated Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in SEPPmail Secure Email Gateway versions prior to 15.0.2.1. This vulnerability arises in the new GINA user interface, where an endpoint improperly handles attacker-controlled input by passing it from a parameter to Perl's eval function, allowing for the execution of arbitrary code.

Impact

Exploitation of this vulnerability allows for unauthenticated remote code execution on the server where SEPPmail Secure Email Gateway is running.

Remediation

Users can update to SEPPmail Secure Email Gateway version 15.0.2.1 or later, where this vulnerability has been fixed.