listmonk 6.2.0 before 7.0.0-beta.2 Missing Authentication via Azure Bounce Webhook
概要
listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated attackers to submit Azure Event Grid bounce webhooks when no shared secret is configured. Attackers can POST forged EmailDeliveryReportReceived events with Bounced status to /webhooks/servi...
影響パッケージ
| パッケージ | 影響を受ける版 → 修正版 | |
|---|---|---|
| knadhlistmonk |
6.2.0 以上 7.0.0-beta.2 未満→ 7.0.0-beta.2 |
7.0.0-beta.2 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated attackers to submit Azure Event Grid bounce webhooks when no shared secret is configured. Attackers can POST forged EmailDeliveryReportReceived events with Bounced status to /webhooks/service/azure to blocklist, unsubscribe, or delete arbitrary subscribers.
出典: CVE.org (CVE Program・cvelistV5) NVD