« Volver al listado

CVE-2024-28064

Estado: AplazadaCrítica (9.8)—

Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with displayLoginChunkedImages) and write operations (with storeLoginChunkedImages).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Totemo — TotemomailAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-28064",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-28064",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-29T20:01:04.316175Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:kiteworks:totemomail:7.0:*:*:*:*:*:*:*"
          ],
          "vendor": "kiteworks",
          "product": "totemomail",
          "versions": [
            {
              "status": "affected",
              "version": "7.0",
              "lessThan": "8.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:kiteworks:totemomail:8.0:*:*:*:*:*:*:*"
          ],
          "vendor": "kiteworks",
          "product": "totemomail",
          "versions": [
            {
              "status": "affected",
              "version": "8.0",
              "lessThan": "8.3.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-18T22:15:07.343",
  "references": [
    {
      "url": "https://www.objectif-securite.ch/advisories/totemomail-path-traversal.txt",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.objectif-securite.ch/advisories/totemomail-path-traversal.txt",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-26"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations (with displayLoginChunkedImages) and write operations (with storeLoginChunkedImages)."
    },
    {
      "lang": "es",
      "value": "Kiteworks Totemomail 7.x y 8.x anteriores a 8.3.0 permiten directory traversal en /responsiveUI/EnvelopeOpenServlet messageId para operaciones de lectura y eliminación de archivos no autenticados (con displayLoginChunkedImages) y operaciones de escritura (con storeLoginChunkedImages)."
    }
  ],
  "lastModified": "2026-06-17T07:20:53.997",
  "sourceIdentifier": "cve@mitre.org"
}