CVE-2019-19200

Related Files

MailDepot 2032 SP2 (2.2.1242) Authorization Bypass

Posted Oct 2, 2020

Authored by Micha Borrmann | Site syss.de

MailDepot version 2032 SP2 (2.2.1242) suffers from an improper authorization vulnerability. The REDDOXX MailDepot web service does not correctly verify whether a user has the proper rights to access specified mailboxes in a corresponding web service request. The web service request will only be processed if it contains a valid authentication token (usual REST web service), but the names of the mailboxes to be accessed are given within a JSON object which is not validated properly regarding user access permissions. Thus, any authenticated user can access mailboxes of other users due to improper authorization checks.

tags | exploit, web

advisories | CVE-2019-19200

SHA-256 | 32ab4f6645b5760f2cd58298371554aeca5c3729abaf3ad7500e4ee9b6054b7e

Download | Favorite | View