CVE-2020-7918 - An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read and modify mail folder names of other users via enumeration

Back Back to CVE browser

MEDIUM

An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read and modify mail folder names of other users via enumeration

Published Mar 27, 2020

5.4

MEDIUM

CVSS 3.1

EPSS 0.73%

Description

An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read and modify mail folder names of other users via enumeration.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-639

Authorization Bypass

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28850
Advisory
https://objectif-securite.ch/2020/03/20/IDOR-totemo-mail-folder.html
x_refsource_MISCThird Party Advisory
https://www.totemo.com/en/solutions/email-encryption
x_refsource_MISCProductVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28850		Advisory
https://objectif-securite.ch/2020/03/20/IDOR-totemo-mail-folder.html		x_refsource_MISCThird Party Advisory
https://www.totemo.com/en/solutions/email-encryption		x_refsource_MISCProductVendor Advisory