Security vulnerability: Ability to bypass quarantine authentication - Messaging Gateway (SMG)

Products

• Messaging Gateway

Issue/Introduction

Users may encounter an issue where quarantine notification links permit access to email quarantine without requiring a password, potentially exposing sensitive email headers if the link is intercepted or shared.

 

Environment

SMG 10.7 10.8 10.9

Resolution

This behavior is resolved in Messaging Gateway 10.9. Administrators can now enforce authentication for these links by navigating to Spam > Quarantine Settings > End User Settings and selecting the option to require login for quarantine links."