CVE-2025-65319
BaseFortify
Publication date: 2025-12-16
Last updated on: 2025-12-17
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| blue | blue_mail | 1.140.103 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-693 | The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid using Blue Mail versions 1.140.103 and below for attachment interactions, as these versions save documents without a Mark-of-the-Web tag, allowing attackers to bypass file protection mechanisms. Updating Blue Mail to a version above 1.140.103 that addresses this issue is recommended. Additionally, exercise caution when opening attachments from untrusted sources to prevent exploitation.
Can you explain this vulnerability to me?
This vulnerability occurs in Blue Mail versions 1.140.103 and below when using the attachment interaction functionality. The application saves documents to the file system without applying a Mark-of-the-Web tag. This omission allows attackers to bypass the built-in file protection mechanisms of Windows OS and third-party software, potentially leading to security risks.
How can this vulnerability impact me? :
Because the Mark-of-the-Web tag is missing when saving attachments, attackers can bypass Windows and third-party file protection mechanisms. This could allow malicious files to execute or be accessed without the usual security warnings or restrictions, increasing the risk of malware infection or unauthorized code execution on the affected system.