| शीर्षक | kalcaddle kodbox 1.68.10 Improper Access Controls |
|---|
| विवरण | A vulnerability was found in kodbox 1.68.10, affecting the msgWarning notification-center plugin version 1.27. The plugin exposes administrative action and table endpoints without authentication or CSRF protection because plugin authorization is configured for all users and plugin routes bypass the normal login check. A remote unauthenticated attacker can read the global SMTP configuration, including stored SMTP credentials when custom SMTP is configured, overwrite the SMTP server and credentials, and disable system notification events. Successful exploitation requires the msgWarning plugin to be installed and enabled and the web interface to be reachable. No user interaction or valid credentials are required. The issue may lead to sensitive credential disclosure, unauthorized modification of global mail configuration, redirection of system emails, and suppression of disk, storage, backup, and account-security alerts. |
|---|
| स्रोत | ⚠️ https://github.com/k0relapse/DOC/blob/master/Unauthenticated%20SMTP%20Credential%20Disclosure%20and%20Notification%20Configuration%20Tampering%20in%20kodbox%201.68.10.md |
|---|
| उपयोगकर्ता | k0re (UID 100317) |
|---|
| सबमिशन | 04/08/2026 05:07 AM (2 महीनों पहले) |
|---|
| संयम | 27/09/2026 05:18 AM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 385631 [kalcaddle kodbox 1.67 Build 02 msgWarning Plugin action अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|