CVE Vulnerability Catalog

The sandbox isolating document conversion on a Kiteworks appliance did not fully confine code, potentially allowing escape and execution with the service account's privileges. An attacker could read or modify application data and configuration, or disrupt the service.

A Kiteworks appliance setup interface did not confine a user-supplied file path, allowing an unauthenticated attacker to write files to arbitrary writable locations. Exploitation requires network access to the interface, which is not reachable on a fully configured appliance by default.

A form-rendering interface in Advanced Forms is reachable without authentication but returned more data than required. Anyone knowing the URL of a published form could retrieve the owner's profile and parts of deployment configuration; no passwords or tokens were exposed.

A privilege escalation vulnerability in Kiteworks could allow an attacker with code execution on one cluster node to run OS commands with elevated privileges on another node. Insufficient input validation in an internal cluster management function allowed attacker-supplied values to reach a privileged context.

A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations. This could potentially be leveraged to execute arbitrary code on the underlying system.

A local privilege escalation vulnerability in Kiteworks could allow an attacker with an existing shell under a low-privileged service account to escalate to root privileges on the appliance.

On deployments with remote-support enabled, an authenticated System Administrator with the key protecting submitted data could redirect the outbound support connection to a chosen destination. That destination could execute OS commands on the node and receive output, potentially leading to remote code execution.

A weakness could allow an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the application to execute it, potentially resulting in remote code execution as the underlying service account.

A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary OS commands as root on the affected node. Successful exploitation requires an administrative account with elevated privileges.

A privilege escalation vulnerability in Kiteworks allows an attacker who already has code execution as an unprivileged backend service account to escalate to root. A privileged routine unsafely handled a filesystem path influenced by the lower-privileged account, allowing arbitrary command execution with highest privileges. Exploitation requires existing local access to that service account.

A privilege escalation vulnerability in Kiteworks allows an attacker who already has code execution as an unprivileged backend service account to escalate to root and run arbitrary commands with highest privileges. Exploitation requires existing local access to that service account.

A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitation requires an authenticated session and applies only to deployments where a specific optional feature is in use.

An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account. Exploitation requires an administrator account holding a specific queue-management privilege.

Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting in remote code execution on the appliance. Exploitation depends on an attacker first being able to influence the affected data, so this issue is not exploitable on its own.

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. An authenticated user could submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated session. This could be used to perform actions on the victim's behalf and may have permitted account takeover, including of higher-privileged users. Exploitation requires the victim to view the attacker-supplied content.

Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction of a user-supplied file path in a Kiteworks administrative export feature could allow an authenticated administrator to write a file to an arbitrary location on the underlying host, potentially leading to command execution on the appliance. Exploitation requires an existing, authenticated administrative account with access to the affected export function.

Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an authenticated administrator to read sensitive data from the underlying database and to affect the availability of the service. Exploitation requires an existing, authenticated administrative account with access to the affected reporting function.

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. The gateway allowed an authenticated administrator to import configuration whose contents were not sufficiently validated before being processed. A crafted submission could potentially allow arbitrary commands to be executed on the affected gateway.

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary operating-system commands, potentially with elevated privileges, on the affected appliance.

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cause the gateway to load and execute code beyond the approved set of mail-processing components, potentially in the context of the mail-gateway service account.