| Package | Affected versions | Patched versions |
|---|---|---|
| kiteworks | < 9.5.1 | 9.5.1 |
On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deserialized without sufficient validation, potentially allowing code execution as the gateway service account. Replication is disabled by default, and exploitation requires control of a trusted cluster peer or administrative access to the appliance.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free