Expert Mail
Monthly
Brute-force attacks against the Pusula Expert Mail authentication surface can succeed because the product does not adequately control the frequency of repeated login attempts, a CWE-799 anti-automation weakness rated CVSS 5.3. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), the flaw is remotely reachable with no authentication, no privileges, and no user interaction, meaning default-configuration instances that expose a webmail or login endpoint are affected; impact is limited to confidentiality, so a successful attack only yields whatever credentials are weak or guessable. There is no CISA KEV listing and no public exploit identified at time of analysis, and the issue was reported by TR-CERT; feasibility drops sharply where a WAF, IP rate limiting, external MFA, or network segmentation sits in front of the login endpoint.
Brute-force attacks against the Pusula Expert Mail authentication surface can succeed because the product does not adequately control the frequency of repeated login attempts, a CWE-799 anti-automation weakness rated CVSS 5.3. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), the flaw is remotely reachable with no authentication, no privileges, and no user interaction, meaning default-configuration instances that expose a webmail or login endpoint are affected; impact is limited to confidentiality, so a successful attack only yields whatever credentials are weak or guessable. There is no CISA KEV listing and no public exploit identified at time of analysis, and the issue was reported by TR-CERT; feasibility drops sharply where a WAF, IP rate limiting, external MFA, or network segmentation sits in front of the login endpoint.