PT-2001-2345 · Ipswitch · Ipswitch Imail

Publicado 2001-12-31 · Atualizado 2008-09-05 · CVE-2001-1211

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ipswitch IMail versions 7.0.4 and earlier

Description The issue allows attackers with administrator privileges to read and modify user alias and mailing list information for other domains hosted by the same server. This is due to the aliasadmin or listadm1 CGI programs not properly verifying that an administrator is the administrator for the target domain.

Recommendations For Ipswitch IMail versions 7.0.4 and earlier, consider restricting access to the aliasadmin and listadm1 CGI programs until a proper fix is available. As a temporary workaround, ensure that only trusted administrators have access to these programs to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2001-1211

Produtos afetados

Ipswitch Imail

Referências · 6

• http://securityfocus.com/archive/1/247786 · Aviso do Fabricante
• http://support.ipswitch.com/kb/IM-20011219-DM01.htm · Nota
• http://iss.net/security_center/static/7752.php · Aviso do Fabricante
• http://securityfocus.com/bid/3766 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2001-1211 · Nota de Segurança
• http://support.ipswitch.com/kb/IM-20020301-DM02.htm · Nota