PT-2018-9555 · K 9 Mail · K-9 Mail

Publicado 2018-12-20 · Atualizado 2019-01-08 · CVE-2018-1000831

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions K9Mail versions prior to v5.601

Description The issue concerns a XML External Entity (XXE) vulnerability in the WebDAV response parser. This can lead to disclosure of confidential data, denial of service, Server-Side Request Forgery (SSRF), and port scanning. The attack is exploitable via a malicious WebDAV server or by intercepting the response of a valid WebDAV server.

Recommendations For versions prior to v5.601, update to version v5.601 or later to resolve the issue. As a temporary workaround, consider restricting access to WebDAV servers to minimize the risk of exploitation. Avoid using potentially malicious WebDAV servers until the issue is resolved.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2018-1000831

Produtos afetados

K-9 Mail

Referências · 4

• https://github.com/k9mail/k-9/issues/3681 · Nota
• https://osv.dev/vulnerability/CVE-2018-1000831 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000831 · Nota de Segurança
• https://0dd.zone/2018/10/28/k9mail-XXE-MitM · Nota