Details of VAR-201506-0202

ID

VAR-201506-0202

CVE

CVE-2014-0999

TITLE

Sendio Vulnerability in which important information is obtained

Trust: 0.8

sources: JVNDB: JVNDB-2014-008067

DESCRIPTION

Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header. Sendio ESP (Email Security Platform) is a network device that provides anti-spam and anti-virus solutions for enterprises in Sendio, USA. A security vulnerability exists in versions prior to Sendio ESP 7.2.4. Because there is a session identifier in the message. Sendio ESP is prone to multiple information-disclosure vulnerabilities. Attackers can exploit these issues to obtain sensitive information that may lead to further attacks

Trust: 2.52

sources: NVD: CVE-2014-0999 // JVNDB: JVNDB-2014-008067 // CNVD: CNVD-2015-03577 // BID: 74786 // VULMON: CVE-2014-0999

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2015-03577

AFFECTED PRODUCTS

vendor:	sendio	model:	sendio	scope:	lte	version:	7.2.3	Trust: 1.0
vendor:	sendio	model:	sendio	scope:	lt	version:	7.2.4	Trust: 0.8
vendor:	sendio	model:	esp	scope:	lt	version:	7.2.4	Trust: 0.6
vendor:	sendio	model:	sendio	scope:	eq	version:	7.2.3	Trust: 0.6
vendor:	sendio	model:	esp	scope:	eq	version:	0	Trust: 0.3
vendor:	sendio	model:	sendio	scope:	eq	version:	6(14.1120.0)	Trust: 0.3
vendor:	sendio	model:	sendio	scope:	ne	version:	7.2.4	Trust: 0.3

sources: CNVD: CNVD-2015-03577 // BID: 74786 // JVNDB: JVNDB-2014-008067 // CNNVD: CNNVD-201506-027 // NVD: CVE-2014-0999

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2014-0999
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2014-0999
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2015-03577
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201506-027
value:	MEDIUM
Trust: 0.6
VULMON:	CVE-2014-0999
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2014-0999
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2015-03577
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

sources: CNVD: CNVD-2015-03577 // VULMON: CVE-2014-0999 // JVNDB: JVNDB-2014-008067 // CNNVD: CNNVD-201506-027 // NVD: CVE-2014-0999

PROBLEMTYPE DATA

problemtype:

CWE-200

Trust: 1.8

sources: JVNDB: JVNDB-2014-008067 // NVD: CVE-2014-0999

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201506-027

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201506-027

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-008067

EXPLOIT AVAILABILITY

sources: VULMON: CVE-2014-0999

PATCH

title:	21-May-2015 Version 7.2.4 Improvements, Security and Bug Fix Updates	url:	http://www.sendio.com/software-release-history/	Trust: 0.8
title:	Sendio ESP 'jsessionid' patch for information disclosure vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/59285	Trust: 0.6
title:	martingalloar	url:	https://github.com/martingalloar/martingalloar	Trust: 0.1
title:	publications	url:	https://github.com/martingalloar/publications	Trust: 0.1

sources: CNVD: CNVD-2015-03577 // VULMON: CVE-2014-0999 // JVNDB: JVNDB-2014-008067

EXTERNAL IDS

db:	NVD	id:	CVE-2014-0999	Trust: 3.4
db:	PACKETSTORM	id:	132022	Trust: 2.5
db:	EXPLOIT-DB	id:	37114	Trust: 2.3
db:	JVNDB	id:	JVNDB-2014-008067	Trust: 0.8
db:	CNVD	id:	CNVD-2015-03577	Trust: 0.6
db:	CNNVD	id:	CNNVD-201506-027	Trust: 0.6
db:	BID	id:	74786	Trust: 0.4
db:	VULMON	id:	CVE-2014-0999	Trust: 0.1

sources: CNVD: CNVD-2015-03577 // VULMON: CVE-2014-0999 // BID: 74786 // JVNDB: JVNDB-2014-008067 // CNNVD: CNNVD-201506-027 // NVD: CVE-2014-0999

REFERENCES

url:	http://packetstormsecurity.com/files/132022/sendio-esp-information-disclosure.html	Trust: 2.5
url:	http://www.exploit-db.com/exploits/37114	Trust: 1.7
url:	http://www.sendio.com/software-release-history/	Trust: 1.7
url:	http://seclists.org/fulldisclosure/2015/may/95	Trust: 1.7
url:	http://www.securityfocus.com/archive/1/535592/100/0/threaded	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0999	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0999	Trust: 0.8
url:	https://www.exploit-db.com/exploits/37114/	Trust: 0.7
url:	http://www.securityfocus.com/archive/1/archive/1/535592/100/0/threaded	Trust: 0.6
url:	http://www.sendio.com/	Trust: 0.3
url:	http://www.coresecurity.com/advisories/sendio-esp-information-disclosure-vulnerability	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/200.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://github.com/martingalloar/martingalloar	Trust: 0.1
url:	https://www.securityfocus.com/bid/74786	Trust: 0.1

sources: CNVD: CNVD-2015-03577 // VULMON: CVE-2014-0999 // BID: 74786 // JVNDB: JVNDB-2014-008067 // CNNVD: CNNVD-201506-027 // NVD: CVE-2014-0999

CREDITS

Martin Gallo from Core Security's Consulting Services Team

Trust: 0.3

sources: BID: 74786

SOURCES

db:	CNVD	id:	CNVD-2015-03577
db:	VULMON	id:	CVE-2014-0999
db:	BID	id:	74786
db:	JVNDB	id:	JVNDB-2014-008067
db:	CNNVD	id:	CNNVD-201506-027
db:	NVD	id:	CVE-2014-0999

LAST UPDATE DATE

2025-04-13T23:09:49.619000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2015-03577	date:	2015-06-04T00:00:00
db:	VULMON	id:	CVE-2014-0999	date:	2018-10-09T00:00:00
db:	BID	id:	74786	date:	2015-05-22T00:00:00
db:	JVNDB	id:	JVNDB-2014-008067	date:	2015-06-04T00:00:00
db:	CNNVD	id:	CNNVD-201506-027	date:	2015-06-05T00:00:00
db:	NVD	id:	CVE-2014-0999	date:	2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2015-03577	date:	2015-06-04T00:00:00
db:	VULMON	id:	CVE-2014-0999	date:	2015-06-02T00:00:00
db:	BID	id:	74786	date:	2015-05-22T00:00:00
db:	JVNDB	id:	JVNDB-2014-008067	date:	2015-06-04T00:00:00
db:	CNNVD	id:	CNNVD-201506-027	date:	2015-06-03T00:00:00
db:	NVD	id:	CVE-2014-0999	date:	2015-06-02T14:59:00.067