Threat Investigation
Request a demo

CVE-2024-45438

Critical

Description

An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. The file quarantine.php within the SpamTitan interface allows unauthenticated users to trigger account-level actions using a crafted GET request. Notably, when a non-existent email address is provided as part of the email parameter, SpamTitan will automatically create a user record and associate quarantine settings with it - all without requiring authentication.

SeverityCritical
CVSS9.1
Exploit probability—
ProductSpamTitan Email Security Gateway
PublishedAug 21, 2025
First seenAug 21, 2025
Weakness typeCWE-306Missing authentication for critical functionCWE-284Improper access control

How to fix

Update
  • TitanHQ SpamTitan Email Security Gateway8.00.101, 8.01.14 or later

Affected products

ProductAffected versionsFixed in
TitanHQ SpamTitan Email Security Gateway8.00.x ≤ v, 8.01.x ≤ v8.00.101, 8.01.14

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.