Trovebox 4.0.0-rc6 SQL Injection / Bypss / SSRF

Telekom Security security.telekom.com Advisory: Trovebox - Authentication Bypass, SQLi, SSRF Release Date: 2018/04/30 Author: Robin Verton [email protected] CVE: requested Application: Trovebox getAttribute'passwordToken'; if$tokenFromDb != $token return $this-error'Could not validate...

Trovebox 4.0.0-rc6 SQL Injection / Bypss / SSRF Vulnerabilties

Trovebox versions 4.0.0-rc6 and below suffer from authentication bypass, server-side request forgery, unsafe token generation, nd remote SQL injection vulnerabilities. Advisory: Trovebox - Authentication Bypass, SQLi, SSRF Release Date: 2018/04/30 Author: Robin Verton email protected CVE: request...