Skip to content

Potential email-spoofing due to no DMARC record in the DNS for uxlfoundation.org domain

Moderate
rozhukov published GHSA-3fhg-6vxg-4m5h Dec 16, 2024

Package

No package listed

Affected versions

prior December, 3rd, 2024

Patched versions

after December, 3rd, 2024

Description

Impact

Email service at uxlfoundation.org is used primarily as an aggregation engine (aka "faceless"), not directly connected to any personal emails and is not used as a normal corporate email service. Thus, is considered low risk by default.

The absence of a DMARC (Domain-based Message Authentication, Reporting & Conformance) record in the DNS configuration of a domain can lead to security vulnerabilities related to email spoofing and phishing attacks. Without a DMARC record, it is difficult to enforce policies for email authentication, making it easier for attackers to send emails that appear to come from the domain. This can result in users being tricked into divulging sensitive information or clicking on malicious links, compromising the confidentiality and integrity of their data.

###Patches
To address this issue, a DMARC record was added to their DNS configuration. This record specifies policies for handling emails that fail authentication checks, thereby reducing the risk of email spoofing and phishing attacks. No specific actions required from users.

Credits

We would like to thank Kunal Mhaske for identifying and reporting this vulnerability. Their diligent work and responsible disclosure have been invaluable in helping to protect UXL community.

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CVE ID

No known CVE