CVE-2024-28064: Critical severity Kiteworks Totemomail vulnerability
Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with displayLoginChunkedImages) and write operations (with storeLoginChunkedImages).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28064?
CVE-2024-28064 is classified as a high severity vulnerability due to its potential for unauthenticated file read, delete, and write operations.
How do I fix CVE-2024-28064?
To remediate CVE-2024-28064, it is recommended to upgrade Kiteworks TotemoMail to version 8.3.0 or later.
What versions of Kiteworks TotemoMail are affected by CVE-2024-28064?
CVE-2024-28064 affects Kiteworks TotemoMail versions 7.x and 8.x before 8.3.0.
What type of attacks can exploit CVE-2024-28064?
CVE-2024-28064 can be exploited for directory traversal attacks, allowing unauthorized access to files and potential data manipulation.
Is authentication required to exploit CVE-2024-28064?
No, CVE-2024-28064 allows for unauthenticated access, making it particularly dangerous.