PT-2002-1541 · Instant Web Mail · Instant Web Mail

Publicado 2002-08-12 · Atualizado 2008-09-05 · CVE-2002-0490

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Instant Web Mail versions prior to 0.60

Description The issue allows remote attackers to execute arbitrary POP commands via the id parameter in "message.php", or modify certain mail message headers via numerous parameters in "write.php" due to improper filtering of CR/LF sequences.

Recommendations For Instant Web Mail versions prior to 0.60, update to version 0.60 or later to resolve the issue. As a temporary workaround, consider restricting access to the "message.php" and "write.php" scripts until the update is applied. Avoid using the id parameter in "message.php" and numerous parameters in "write.php" until the issue is resolved.

Correção

Identificadores relacionados

CVE-2002-0490

Produtos afetados

Instant Web Mail

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2002-0490 · Nota de Segurança
• http://instantwebmail.sourceforge.net/#changeLog · Nota
• http://iss.net/security_center/static/8650.php · Aviso do Fabricante
• http://securityfocus.com/archive/1/264041 · Aviso do Fabricante
• http://securityfocus.com/bid/4361 · Aviso do Fabricante