Kiteworks Email Protection Gateway Insufficient Session Expiration Vulnerability

A session management vulnerability has been identified in Kiteworks Email Protection Gateway versions prior to 9.2.1. This vulnerability allows users with blocked accounts to retain active sessions even after their accounts have been disabled. As a result, these users could potentially access the system without authorization until their sessions naturally expire.

Impact

Exploitation of this vulnerability could lead to unauthorized access by allowing blocked users to maintain active sessions after their accounts have been disabled.

Remediation

Users are advised to upgrade Kiteworks to version 9.2.1 or later.