Citadel
Citadel Webcit: vulnerabilities and CVEs
Citadel Webcit has 9 published vulnerabilities, 0 of them in the last 12 months. 1 are rated critical and 0 are listed by CISA as actively exploited.
CVEs9
Last 12 months0
Critical1
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2021-37845 | Low (3.7) | 0.66% | — | May 29, 2023 | An issue was discovered in Citadel through webcit-932. A meddler-in-the-middle attacker can fixate their own session during the cleartext phase before a STARTTLS command (a violation of "The STARTTLS command is only… |
| CVE-2020-29547 | Medium (5.9) | 0.75% | — | May 29, 2023 | An issue was discovered in Citadel through webcit-926. Meddler-in-the-middle attackers can pipeline commands after POP3 STLS, IMAP STARTTLS, or SMTP STARTTLS commands, injecting cleartext commands into an encrypted user… |
| CVE-2020-27742 | Medium (6.5) | 1.1% | — | Oct 28, 2020 | An Insecure Direct Object Reference vulnerability in Citadel WebCit through 926 allows authenticated remote attackers to read someone else's emails via the msg_confirm_move template. NOTE: this was reported to the… |
| CVE-2020-27741 | Medium (6.1) | 1.1% | — | Oct 28, 2020 | Multiple cross-site scripting (XSS) vulnerabilities in Citadel WebCit through 926 allow remote attackers to inject arbitrary web script or HTML via multiple pages and parameters. NOTE: this was reported to the vendor in… |
| CVE-2020-27740 | Medium (5.3) | 1.3% | — | Oct 28, 2020 | Citadel WebCit through 926 allows unauthenticated remote attackers to enumerate valid users within the platform. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit… |
| CVE-2020-27739 | Critical (9.8) | 1.8% | — | Oct 28, 2020 | A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack recently logged-in users' sessions. NOTE: this was reported to the vendor in a publicly archived… |
| CVE-2009-0364 | High (7.5) | 2.6% | — | Mar 26, 2009 | Format string vulnerability in the mini_calendar component in Citadel.org WebCit 7.22, and other versions before 7.39, allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2007-3821 | High (7.5) | 2.7% | — | Jul 17, 2007 | Cross-site request forgery (CSRF) vulnerability in Webcit before 7.11 allows remote attackers to modify configurations and perform other actions as arbitrary users via unspecified vectors. |
| CVE-2007-3822 | Low (2.6) | 2.5% | — | Jul 17, 2007 | Multiple cross-site scripting (XSS) vulnerabilities in Webcit before 7.11 allow remote attackers to inject arbitrary web script or HTML via (1) the who parameter to showuser; and other vectors involving (2) calendar… |