PT-2019-15920 · Modoboa · Modoboa

Pjlantz · Published 2019-12-10 · Updated 2022-05-24 · CVE-2019-19702

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Modoboa modoboa-dmarc plugin version 1.1.0

Description The issue allows for an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionality. This can be achieved by referencing sensitive files within XML documents emailed to the address in the rua field of the DMARC records of a domain.

Recommendations For Modoboa modoboa-dmarc plugin version 1.1.0, consider disabling the DMARC reporting functionality until a patch is available to prevent exploitation. Restrict access to the XML processing module to minimize the risk of denial of service attacks. Avoid using the rua field in DMARC records to receive XML documents from untrusted sources.

Exploit

Fix

XXE

Weakness Enumeration

CWE-91

CWE-611

Related Identifiers

CVE-2019-19702

GHSA-VC42-MGR2-W34R

PYSEC-2019-105

Affected Products

Modoboa

References · 9

• 🔥 https://github.com/modoboa/modoboa-dmarc/issues/38 · Exploit
• https://osv.dev/vulnerability/GHSA-vc42-mgr2-w34r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19702 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19702 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-105 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/modoboa/PYSEC-2019-251.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/modoboa-dmarc/PYSEC-2019-105.yaml · Note
• https://github.com/modoboa/modoboa-dmarc · Note
• https://github.com/modoboa/modoboa-dmarc/commit/14c29e0ad9487bdbe4cc0bd1f8bc711285bf9933 · Note