Vulnerability-Lookup

VAR-201506-0202

Vulnerability from variot - Updated: 2025-04-13 23:09

Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header. Sendio ESP (Email Security Platform) is a network device that provides anti-spam and anti-virus solutions for enterprises in Sendio, USA. A security vulnerability exists in versions prior to Sendio ESP 7.2.4. Because there is a session identifier in the message. Sendio ESP is prone to multiple information-disclosure vulnerabilities. Attackers can exploit these issues to obtain sensitive information that may lead to further attacks

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201506-0202",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "sendio",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "sendio",
        "version": "7.2.3"
      },
      {
        "model": "sendio",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "sendio",
        "version": "7.2.4"
      },
      {
        "model": "esp",
        "scope": "lt",
        "trust": 0.6,
        "vendor": "sendio",
        "version": "7.2.4"
      },
      {
        "model": "sendio",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sendio",
        "version": "7.2.3"
      },
      {
        "model": "esp",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sendio",
        "version": "0"
      },
      {
        "model": "sendio",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sendio",
        "version": "6(14.1120.0)"
      },
      {
        "model": "sendio",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "sendio",
        "version": "7.2.4"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-03577"
      },
      {
        "db": "BID",
        "id": "74786"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008067"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201506-027"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0999"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:sendio:sendio",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008067"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Martin Gallo from Core Security\u0027s Consulting Services Team",
    "sources": [
      {
        "db": "BID",
        "id": "74786"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2014-0999",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2014-0999",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2015-03577",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2014-0999",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2014-0999",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2015-03577",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201506-027",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2014-0999",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-03577"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0999"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008067"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201506-027"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0999"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header. Sendio ESP (Email Security Platform) is a network device that provides anti-spam and anti-virus solutions for enterprises in Sendio, USA. A security vulnerability exists in versions prior to Sendio ESP 7.2.4. Because there is a session identifier in the message. Sendio ESP is prone to multiple information-disclosure vulnerabilities. \nAttackers can exploit these issues to obtain sensitive information that may lead to further attacks",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-0999"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008067"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-03577"
      },
      {
        "db": "BID",
        "id": "74786"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0999"
      }
    ],
    "trust": 2.52
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=37114",
        "trust": 0.1,
        "type": "exploit"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2014-0999"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-0999",
        "trust": 3.4
      },
      {
        "db": "PACKETSTORM",
        "id": "132022",
        "trust": 2.5
      },
      {
        "db": "EXPLOIT-DB",
        "id": "37114",
        "trust": 2.3
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008067",
        "trust": 0.8
      },
      {
        "db": "CNVD",
        "id": "CNVD-2015-03577",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201506-027",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "74786",
        "trust": 0.4
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0999",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-03577"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0999"
      },
      {
        "db": "BID",
        "id": "74786"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008067"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201506-027"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0999"
      }
    ]
  },
  "id": "VAR-201506-0202",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-03577"
      }
    ],
    "trust": 1.4333333000000001
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-03577"
      }
    ]
  },
  "last_update_date": "2025-04-13T23:09:49.619000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "21-May-2015 Version 7.2.4 Improvements, Security and Bug Fix Updates",
        "trust": 0.8,
        "url": "http://www.sendio.com/software-release-history/"
      },
      {
        "title": "Sendio ESP \u0027jsessionid\u0027 patch for information disclosure vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/59285"
      },
      {
        "title": "martingalloar",
        "trust": 0.1,
        "url": "https://github.com/martingalloar/martingalloar "
      },
      {
        "title": "publications",
        "trust": 0.1,
        "url": "https://github.com/martingalloar/publications "
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-03577"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0999"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008067"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-200",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008067"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0999"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.5,
        "url": "http://packetstormsecurity.com/files/132022/sendio-esp-information-disclosure.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.exploit-db.com/exploits/37114"
      },
      {
        "trust": 1.7,
        "url": "http://www.sendio.com/software-release-history/"
      },
      {
        "trust": 1.7,
        "url": "http://seclists.org/fulldisclosure/2015/may/95"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/archive/1/535592/100/0/threaded"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0999"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0999"
      },
      {
        "trust": 0.7,
        "url": "https://www.exploit-db.com/exploits/37114/"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/archive/1/archive/1/535592/100/0/threaded"
      },
      {
        "trust": 0.3,
        "url": "http://www.sendio.com/"
      },
      {
        "trust": 0.3,
        "url": "http://www.coresecurity.com/advisories/sendio-esp-information-disclosure-vulnerability"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/200.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/martingalloar/martingalloar"
      },
      {
        "trust": 0.1,
        "url": "https://www.securityfocus.com/bid/74786"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-03577"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0999"
      },
      {
        "db": "BID",
        "id": "74786"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008067"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201506-027"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0999"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2015-03577"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0999"
      },
      {
        "db": "BID",
        "id": "74786"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008067"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201506-027"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0999"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-06-04T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2015-03577"
      },
      {
        "date": "2015-06-02T00:00:00",
        "db": "VULMON",
        "id": "CVE-2014-0999"
      },
      {
        "date": "2015-05-22T00:00:00",
        "db": "BID",
        "id": "74786"
      },
      {
        "date": "2015-06-04T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-008067"
      },
      {
        "date": "2015-06-03T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201506-027"
      },
      {
        "date": "2015-06-02T14:59:00.067000",
        "db": "NVD",
        "id": "CVE-2014-0999"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-06-04T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2015-03577"
      },
      {
        "date": "2018-10-09T00:00:00",
        "db": "VULMON",
        "id": "CVE-2014-0999"
      },
      {
        "date": "2015-05-22T00:00:00",
        "db": "BID",
        "id": "74786"
      },
      {
        "date": "2015-06-04T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-008067"
      },
      {
        "date": "2015-06-05T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201506-027"
      },
      {
        "date": "2025-04-12T10:46:40.837000",
        "db": "NVD",
        "id": "CVE-2014-0999"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201506-027"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Sendio Vulnerability in which important information is obtained",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008067"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "information disclosure",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201506-027"
      }
    ],
    "trust": 0.6
  }
}

CVE-2014-0999 (GCVE-0-2014-0999)

Vulnerability from cvelistv5 – Published: 2015-06-02 14:00 – Updated: 2024-08-06 09:34

Summary

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	http://seclists.org/fulldisclosure/2015/May/95	mailing-listx_refsource_FULLDISC
	http://packetstormsecurity.com/files/132022/Sendi…	x_refsource_MISC
	http://www.securityfocus.com/archive/1/535592/100…	mailing-listx_refsource_BUGTRAQ
	http://www.sendio.com/software-release-history/	x_refsource_CONFIRM
	http://www.exploit-db.com/exploits/37114	exploitx_refsource_EXPLOIT-DB

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T09:34:41.149Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20150522 [CORE-2015-0010] - Sendio ESP Information Disclosure Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2015/May/95"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/132022/Sendio-ESP-Information-Disclosure.html"
          },
          {
            "name": "20150522 [CORE-2015-0010] - Sendio ESP Information Disclosure Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/535592/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.sendio.com/software-release-history/"
          },
          {
            "name": "37114",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/37114"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-05-21T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20150522 [CORE-2015-0010] - Sendio ESP Information Disclosure Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2015/May/95"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/132022/Sendio-ESP-Information-Disclosure.html"
        },
        {
          "name": "20150522 [CORE-2015-0010] - Sendio ESP Information Disclosure Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/535592/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.sendio.com/software-release-history/"
        },
        {
          "name": "37114",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/37114"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-0999",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20150522 [CORE-2015-0010] - Sendio ESP Information Disclosure Vulnerability",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2015/May/95"
            },
            {
              "name": "http://packetstormsecurity.com/files/132022/Sendio-ESP-Information-Disclosure.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/132022/Sendio-ESP-Information-Disclosure.html"
            },
            {
              "name": "20150522 [CORE-2015-0010] - Sendio ESP Information Disclosure Vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/535592/100/0/threaded"
            },
            {
              "name": "http://www.sendio.com/software-release-history/",
              "refsource": "CONFIRM",
              "url": "http://www.sendio.com/software-release-history/"
            },
            {
              "name": "37114",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/37114"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-0999",
    "datePublished": "2015-06-02T14:00:00",
    "dateReserved": "2014-01-07T00:00:00",
    "dateUpdated": "2024-08-06T09:34:41.149Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VAR-201506-0202

CVE-2014-0999 (GCVE-0-2014-0999)

Tags

Sightings

Nomenclature