PT-2020-10086 · Reddoxx · Reddoxx Maildepot

Micha Borrmann · Published 2020-09-29 · Updated 2020-10-13 · CVE-2019-19199

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions REDDOXX MailDepot version 2032 SP2 2.2.1242

Description The issue is related to insufficient session expiration, where tokens are not invalidated upon logout. This can potentially allow unauthorized access to user sessions.

Recommendations For REDDOXX MailDepot version 2032 SP2 2.2.1242, consider implementing a custom session invalidation mechanism upon user logout as a temporary workaround until a patch is available. Restrict access to sensitive features that rely on session tokens to minimize the risk of exploitation.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2019-19199

Affected Products

Reddoxx Maildepot

References · 7

• https://osv.dev/vulnerability/CVE-2019-19199 · Vendor Advisory
• https://reddoxx.com/en/products/archiving · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19199 · Security Note
• https://syss.de/pentest-blog · Note
• https://t.me/defcon_news/58119 · Telegram Post
• http://seclists.org/fulldisclosure/2020/Sep/49 · Note
• https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-049.txt · Note