CVE-2024-51123
Published: 12 February 2025
Summary
CVE-2024-51123 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-14 (Public Access Protections).
Deeper analysis
CVE-2024-51123 is an information disclosure vulnerability (CWE-200) affecting Zertificon Z1 SecureMail Gateway version 4.44.2-7240-debian12. The flaw resides in the /compose-pdf.xhtml?convid=[id] component, where a remote attacker can extract sensitive information. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity due to network accessibility, low attack complexity, and no requirements for privileges or user interaction.
Any remote attacker can exploit this vulnerability without authentication by sending crafted requests to the vulnerable endpoint, potentially leaking confidential data such as user or message details. Successful exploitation enables high-impact confidentiality breaches but does not allow integrity modification or denial of service.
Further details, including potential mitigation guidance, are available in the advisory at https://github.com/MVRC-ITSEC/CVEs/blob/main/CVE-2024-51123. Security practitioners should review this source for version-specific patches or workarounds, as no additional mitigation information is detailed in the CVE publication from February 12, 2025.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4897
Vulnerability details
An issue in Zertificon Z1 SecureMail Z1 SecureMail Gateway 4.44.2-7240-debian12 allows a remote attacker to obtain sensitive information via the /compose-pdf.xhtml?convid=[id] component.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated exploitation of a public-facing web endpoint (/compose-pdf.xhtml) to disclose sensitive data matches T1190 exactly; no other techniques are directly enabled by the described flaw.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring timely remediation of the specific information disclosure flaw through patches or workarounds from the vendor advisory.
Enforces approved authorizations to block unauthorized remote access to sensitive information via the vulnerable /compose-pdf.xhtml?convid=[id] endpoint.
Provides additional protections for publicly accessible network endpoints to prevent unauthenticated disclosure of confidential data.