PT-2000-1649 · Alt N Technologies · Mdaemon

Publicado 2000-10-20 · Atualizado 2017-10-10 · CVE-2000-0716

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions MDaemon version 2.8

Description The issue concerns the WorldClient email client in MDaemon, where the session ID is included in the referer field of an HTTP request when a user clicks on a URL. This allows the visited website to potentially hijack the session ID and access the user's email.

Recommendations For MDaemon version 2.8, consider restricting access to external URLs from within the email client to minimize the risk of session ID hijacking until a fix is available.

Correção

Identificadores relacionados

CVE-2000-0716

Produtos afetados

Mdaemon

Referências · 5

• http://securityfocus.com/bid/1553 · Aviso do Fabricante
• http://ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0008&L=ntbugtraq&F=&S=&P=459 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5070 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0716 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2000-0716 · Nota de Segurança