| Package | Affected versions | Patched versions |
|---|---|---|
| kiteworks | < 9.5.1 | 9.5.1 |
An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service account, including cryptographic key material and credentials, and have them sent to a destination they control.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free