The "XML Interface to Messaging, Scheduling, and Signaling" (XIMSS) protocol implementation in CommuniGate Pro (CGP) 6.2 suffers from a Missing XIMSS Protocol Validation attack that leads to an email spoofing attack, allowing a malicious authenticated attacker to send a message from any source email address. The attack uses an HTTP POST request to a /Session URI, and interchanges the XML From and To elements.
References
Link | Resource |
---|---|
https://packetstormsecurity.com/files/145724/communigatepro62-spoof | Exploit Third Party Advisory VDB Entry |
Configurations
History
No history.
Information
Published : 2018-01-08 05:29
Updated : 2024-02-28 16:04
NVD link : CVE-2018-3815
Mitre link : CVE-2018-3815
CVE.ORG link : CVE-2018-3815
JSON object : View
Products Affected
stalker
- communigate_pro
CWE
CWE-287
Improper Authentication