CVE-2024-28064

Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with displayLoginChunkedImages) and write operations (with storeLoginChunkedImages).

Score

CVSS 3.1 9.8 Critical

Status

Deferred - cve@mitre.org

Published

2024-05-18

Last modified

2025-02-13

Weaknesses

CWE-26

Affected products

• Totemomail (Kiteworks)

References

• https://www.objectif-securite.ch/advisories/totemomail-path-traversal.txt