CVE-2024-28064 - Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with displayLoginChunkedImages) and write operations (with storeLoginChunkedImages)

Back Back to CVE browser

CRITICAL

Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with displayLoginChunkedImages) and write operations (with storeLoginChunkedImages)

Published May 18, 2024

9.8

CRITICAL

CVSS 3.1

EPSS 0.86%

Description

Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with displayLoginChunkedImages) and write operations (with storeLoginChunkedImages).

Affected products

Vendor Kiteworks Product Totemomail Default
n/a
- Version
  7.0
  Status
  affected
  Constraints
  <8.0
- Version
  8.0
  Status
  affected
  Constraints
  <8.3.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Kiteworks

Totemomail

n/a

Version	Status	Constraints
7.0	affected	<8.0
8.0	affected	<8.3.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-26

References (1)

https://www.objectif-securite.ch/advisories/totemomail-path-traversal.txt

Link	Providers	Tags
https://www.objectif-securite.ch/advisories/totemomail-path-traversal.txt

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published May 18, 2024

Updated Feb 13, 2025

Reserved Mar 1, 2024

Link CVE-2024-28064

CISA Vulnrichment

Updated Jul 29, 2024

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2024-28064

Red Hat

Severity n/a

Public date n/a

Links CVE-2024-28064