Viafirma Inbox IDOR Vulnerability Allowing Unauthorized User Data Access and Modification

An Insecure Direct Object Reference (IDOR) vulnerability exists in Viafirma Inbox version 4.5.13. This vulnerability allows any authenticated user, regardless of privileges, to list all users and access and modify their data. Exploiting this flaw enables the modification of user email addresses, which can then be used with the password recovery feature to impersonate any user, including those with administrative rights.

Impact

Exploitation of this vulnerability could lead to unauthorized access to user accounts, including those of administrators, by allowing an attacker to impersonate other users after modifying their email addresses and using the password recovery function.

Remediation

Users can upgrade to Viafirma Inbox version 4.5.27 to address this vulnerability.