13 results · Clear filters · Feed
-
Medium 4.6
Kiteworks Core user impersonation in a file-request feature
Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate from another user, because the server did not verify that the requester was authorized to act as the s…
-
Medium 5.9
Missing authentication on a Kiteworks appliance setup function
An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the initial activation window an unauthenticated network attacker could repeatedly re-trigger the privilege…
-
Medium 4.9
Kiteworks Core Improper Validation of Specified Quantity in Input
Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside its intended range so that the associated control never activated, while the control continued to app…
-
Medium 4.3
Kiteworks Core Incorrect Authorization
Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authenticated user holding the Manager role on a folder could grant the Owner role to themselves or to other members of that fold…
-
Medium 6.5
Kiteworks Core Missing Authentication for Critical Function
A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a con…
-
Medium 6.6
Kiteworks Core Arbitrary File Write through Command Injection
An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and …
-
Medium 5.4
Kiteworks Core Unprotected Alternate Channel
Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, in…
-
Medium 6.3
Kiteworks Core Command Execution through Configuration Injection
In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, poten…
-
Medium 4.1
Kiteworks Core Unrestricted Upload of File with Dangerous Type
An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnera…
-
Medium 4.9
Kiteworks Core Insufficient Verification of Data Authenticity
An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be …
-
Medium 6.7
Kiteworks Core Privilege Escalation through External Control of File Name or Path
Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root onto another node and cause them to be executed there. Exploitation requires backend …
-
Medium 6.6
Kiteworks Core Server-Side Request Forgery through CRLF Injection
An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution.
-
Medium 4.3
Kiteworks Core content injection
Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. T…