Administrator-defined file type restriction bypass in Openwave Webtop Media Transcoder

Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.

• Openwave Messaging (Ireland) Limited Webtop Media Transcoder: versions less than 1.1.22.0 are marked affected.
• Fixed version: the vendor advisory identifies 1.1.22.0 as the version from which the issue is fixed.
• The record marks the default status as unaffected outside the stated range, but this does not establish that every later or parallel release branch has been independently verified.

Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions at the conversion-processing layer. The weakness is classified as CWE-669, concerning an incorrect transfer of resources between control spheres or contexts. An authenticated user can reach conversion processing by bypassing the Webmail experience, allowing the transcoder to process document types that administrative policy did not intend to permit. The attack is network-reachable, requires low-level user privileges, needs no additional user interaction, and has low complexity. Public details do not identify the endpoint, parser, file path, specific format, or exact input condition used to bypass enforcement.

• Reachability: The condition can be reached over the network where the Webtop Media Transcoder service is accessible to authenticated users.
• Authentication: The attacker must be an authenticated user with low-level privileges.
• User interaction: No additional interaction from another user is required.
• Complexity: The record assesses the attack conditions as low complexity.
• Exploitation status: The record sets public_exploit to false, while known_exploited is not established. The current record therefore does not establish active exploitation or a public exploit.

The flaw can cause the transcoder to process and convert document types outside the administrator-defined file type policy. Exploitation requires an authenticated user but does not require administrative privileges, and the effect remains within the same security scope. The recorded technical outcome is a limited availability impact; the record does not identify an effect on confidentiality or integrity. Organizationally, the main risks are partial loss of format-control enforcement and unexpected use of service resources, not evidence of a specific data compromise.

• The flaw can weaken document-type governance by allowing formats that administrators did not intend to permit.
• Valid user accounts may consume conversion resources for documents outside the designed Webmail workflow.
• Out-of-policy processing could increase workload or degrade service availability, consistent with the low availability impact recorded for the issue.
• The record does not identify unauthorized data disclosure, data modification, a specific breach, or an incident that has already occurred.

1. Upgrade Openwave Webtop Media Transcoder to the vendor-identified fixed version 1.1.22.0. The vendor advisory also directs customers to the latest supported Media Server 2.0 release for deployments managed in that product line.
2. After updating, verify that file type restrictions are enforced at the conversion-processing layer itself, including when the function is reached by bypassing the Webmail experience.
3. If an immediate update is not possible, contact the vendor to confirm a supported mitigation. The available evidence does not define a specific temporary workaround.
4. While awaiting the update, limit network and user access to the conversion function to the required business scope. Treat this as exposure reduction, not as a substitute for the vendor fix unless the vendor confirms it.

1. Inventory Openwave Webtop Media Transcoder deployments and identify services that authenticated users can reach over the network.
2. Review the administrator-defined file type policy and compare it with the types the transcoder actually accepts when called outside the Webmail experience.
3. Review integrations and access paths that invoke conversion directly rather than through the normal Webmail workflow.
4. If suitable telemetry is available, examine conversion requests from authenticated accounts involving document types outside policy. This is precautionary monitoring, not a confirmed indicator.
5. Do not treat the absence of suspicious events as proof of safety. Verify the deployed version and confirm that policy enforcement remains effective after updating.