Vulnerability in Vaultive Office 365 Security
CVE-2017-7229
PGP/MIME encrypted messages injected into a Vaultive O365 (before 4.5.21) frontend via IMAP or SMTP have their Content-Type changed from 'Content-Type: multipart/encrypted; protocol="application/pgp-encrypted"; boundary="abc123abc123"' to 'Content-Type: text/plain' - this results in the encrypted message being structured in such a way that most PGP/MIME-capable mail user agents are unable to decrypt it cleanly. The outcome is that encrypted mail passing through this device does not work (Denial of Service), and a common real-world consequence is a request to resend the mail in the clear (Information Disclosure).
EPSS: 0.008 (51.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.
Affected products
- Vaultive Office_365_security — versions 4.5.19
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_MISC)
Frequently asked questions
- What is CVE-2017-7229?
- CVE-2017-7229 is a critical-severity vulnerability in Vaultive Office 365 Security, classified under Inadequate Encryption Strength. CVSS score: 9.1/10. Published 2017-05-03.
- How severe is CVE-2017-7229?
- Critical severity. CVSS v3 base score is 9.1 out of 10.