Use of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other servers from hMailAdmin.exe.config file to access other hMailServer admin consoles with configured connections.
Weakness
The product uses a hard-coded, unchangeable cryptographic key.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Hmailserver | Hmailserver | 5.6.9-beta (including) | 5.6.9-beta (including) |
| Hmailserver | Hmailserver | 5.8.6 (including) | 5.8.6 (including) |