Description (CNA)
Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| froxlor / froxlor | affected 0 before 2.3.7; unaffected 2.3.7 |
CWE
CWE-200
References
- https://github.com/froxlor/froxlor/security/advisories/GHSA-mr9h-45p9-fg8h
- https://www.vulncheck.com/advisories/froxlor-before-2.3.7-information-disclosure-via-customer-email-php
ADP enrichment
No English description supplied.