CVE-2020-7918: totemomail: Insecure Direct Object Reference | Rafael Pfister

Analysis on rafaelpfister.ch

Knowledge Base Totemomail: Email Encryption on the Kiteworks Platform The Totemomail encryption gateway in operation: origins and the takeover by Kiteworks, gateway encryption with S/MIME and PGP, WebMail delivery, LDAP integration, the licensing model based on licensed users, and the M365 integration.

Vendor description

An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read and modify mail folder names of other users via enumeration.

Reference data

Vendor

totemo

Affected products

totemomail

Published

March 27, 2020

Official sources

← All vulnerabilities