DoraCMS 3.0.x Email API Remote Authentication Bypass

Summary

DoraCMS 3.0.x has a security flaw in its Email API that allows attackers to bypass authentication and send emails without permission. This could lead to unauthorized emails being sent from your email account. Update to the latest version of DoraCMS to fix this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
html-js	doracms	All versions	–

Original title

A vulnerability was identified in doramart DoraCMS 3.0.x. This issue affects some unknown processing of the file /api/v1/mail/send of the component Email API. Such manipulation leads to improper au...

Original description

A vulnerability was identified in doramart DoraCMS 3.0.x. This issue affects some unknown processing of the file /api/v1/mail/send of the component Email API. Such manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvd CVSS2.0 7.5

nvd CVSS3.1 7.3

nvd CVSS4.0 6.9

Vulnerability type

CWE-287 Improper Authentication