PT-2001-2413 · Ipswitch · Ipswitch Imail

Publicado 2001-10-12 · Atualizado 2008-09-10 · CVE-2001-1286

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Ipswitch IMail versions 7.04 and earlier

Description: The issue allows remote attackers to hijack sessions by obtaining a URL that contains a user's session ID. This could be achieved via an HTML email that causes the Referrer to be sent to a URL under the attacker's control.

Recommendations: For Ipswitch IMail versions 7.04 and earlier, consider disabling the feature that stores session IDs in URLs as a temporary workaround until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of session hijacking. Avoid using URLs that contain session IDs in HTML emails or other potentially vulnerable communications.

Correção

Identificadores relacionados

CVE-2001-1286

Produtos afetados

Ipswitch Imail

Referências · 5

• http://archives.neohapsis.com/archives/bugtraq/2001-10/0082.html · Nota
• http://ipswitch.com/Support/IMail/news.html · Nota
• http://securityfocus.com/bid/3432 · Nota
• http://online.securityfocus.com/archive/1/261096 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2001-1286 · Nota de Segurança