CVE-2019-19702: XEE
The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionality, such as by referencing the /dev/random file within XML documents that are emailed to the address in the rua field of the DMARC records of a domain.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-19702?
CVE-2019-19702 is a vulnerability in the modoboa-dmarc plugin 1.1.0 for Modoboa that allows an XML External Entity Injection (XXE) attack.
How does CVE-2019-19702 affect Modoboa?
CVE-2019-19702 affects Modoboa when processing XML data, allowing a remote attacker to perform a denial of service against the DMARC reporting functionality.
What is the severity of CVE-2019-19702?
CVE-2019-19702 has a severity rating of high with a CVSS score of 7.5.
How can CVE-2019-19702 be exploited?
CVE-2019-19702 can be exploited by an attacker by referencing the /dev/random file within XML data.
Is there a fix available for CVE-2019-19702?
At the time of writing, there is no available fix for CVE-2019-19702. It is recommended to monitor the vendor's website for updates or apply any recommended patches as they become available.