PT-2019-15920 · Modoboa · Modoboa

Pjlantz · Publicado 2019-12-10 · Atualizado 2022-05-24 · CVE-2019-19702

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Modoboa modoboa-dmarc plugin version 1.1.0

Description The issue allows for an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionality. This can be achieved by referencing sensitive files within XML documents emailed to the address in the rua field of the DMARC records of a domain.

Recommendations For Modoboa modoboa-dmarc plugin version 1.1.0, consider disabling the DMARC reporting functionality until a patch is available to prevent exploitation. Restrict access to the XML processing module to minimize the risk of denial of service attacks. Avoid using the rua field in DMARC records to receive XML documents from untrusted sources.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-91

CWE-611

Identificadores relacionados

CVE-2019-19702

GHSA-VC42-MGR2-W34R

PYSEC-2019-105

Produtos afetados

Modoboa

Referências · 9

• 🔥 https://github.com/modoboa/modoboa-dmarc/issues/38 · Exploit
• https://github.com/pypa/advisory-database/tree/main/vulns/modoboa/PYSEC-2019-251.yaml · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/modoboa-dmarc/PYSEC-2019-105.yaml · Nota
• https://github.com/modoboa/modoboa-dmarc · Nota
• https://github.com/modoboa/modoboa-dmarc/commit/14c29e0ad9487bdbe4cc0bd1f8bc711285bf9933 · Nota
• https://osv.dev/vulnerability/GHSA-vc42-mgr2-w34r · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19702 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-19702 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2019-105 · Aviso do Fabricante