CVE-2020-7918

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read and modify mail folder names of other users via enumeration.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://objectif-securite.ch/2020/03/20/IDOR-totemo-mail-folder.htmlThird Party Advisory
https://www.totemo.com/en/solutions/email-encryptionProduct, Vendor Advisory
https://objectif-securite.ch/2020/03/20/IDOR-totemo-mail-folder.htmlThird Party Advisory
https://www.totemo.com/en/solutions/email-encryptionProduct, Vendor Advisory

Timeline

Published: Mar 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-79197.5Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attack CVE-2020-79207.5pmm-server in Percona Monitoring and Management (PMM) 2.2.x before 2.2.1 allows unauthenticated denial of service.CVE-2020-79215.3Improper serialization of internal state in the authorization subsystem in MongoDB Server's authorization subsystem permits a user with vali CVE-2020-79226.5X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster impro CVE-2020-79236.5A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant i CVE-2020-79246.5Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB CVE-2020-79257.5Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to u CVE-2020-79266.5A user authorized to perform database queries may cause denial of service by issuing a specially crafted query which violates an invariant i CVE-2020-79276.5Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role pri CVE-2020-79286.5A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. T CVE-2020-79296.5A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This CVE-2020-79318.8In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modifying a .ssh/authoriz