Ovhcloud
Monthly
Email spoofing is possible through OVHcloud's shared mail servers, allowing any authenticated OVH email user to forge the sender address to impersonate any OVH-hosted domain that uses the default SPF record include:mx.ovh.com. This vulnerability affects OVHcloud's email service and is assessed as a moderate, bounded risk because exploitation requires a valid account and is mitigated by DMARC with DKIM alignment. The issue stems from an insecure default SPF configuration that authorizes the shared mx.ovh.com infrastructure for all domains using the default record.
Email spoofing is possible through OVHcloud's shared mail servers, allowing any authenticated OVH email user to forge the sender address to impersonate any OVH-hosted domain that uses the default SPF record include:mx.ovh.com. This vulnerability affects OVHcloud's email service and is assessed as a moderate, bounded risk because exploitation requires a valid account and is mitigated by DMARC with DKIM alignment. The issue stems from an insecure default SPF configuration that authorizes the shared mx.ovh.com infrastructure for all domains using the default record.