CVE-2019-19199

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

REDDOXX MailDepot 2032 SP2 2.2.1242 has Insufficient Session Expiration because tokens are not invalidated upon a logout.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2020/Sep/49Mailing List, Third Party Advisory
https://www.reddoxx.com/en/products/archiving/Product, Vendor Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-049.txtThird Party Advisory
https://www.syss.de/pentest-blog/Third Party Advisory
http://seclists.org/fulldisclosure/2020/Sep/49Mailing List, Third Party Advisory
https://www.reddoxx.com/en/products/archiving/Product, Vendor Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-049.txtThird Party Advisory
https://www.syss.de/pentest-blog/Third Party Advisory

Timeline

Published: Oct 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-19207.4A vulnerability in the 802.11r Fast Transition (FT) implementation for Cisco IOS Access Points (APs) Software could allow an unauthenticated CVE-2019-192008.8REDDOXX MailDepot 2032 2.2.1242 allows authenticated users to access the mailboxes of other users.CVE-2019-192028.8In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role b CVE-2019-192037.5An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is derefer CVE-2019-192047.5An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier (formerly known as fetch_range_quantifi CVE-2019-192065.4Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture.CVE-2019-192078.8rConfig 3.9.2 allows devices.php?searchColumn= SQL injection.CVE-2019-192089.8Codiad Web IDE through 2.8.4 allows PHP Code injection.CVE-2019-192097.5Dolibarr ERP/CRM before 10.0.3 allows SQL Injection.CVE-2019-19217.5A vulnerability in the attachment scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated CVE-2019-192105.4Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files.CVE-2019-192116.1Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS.