PT-2003-2426 · Stalker · Communigate Pro

Yaroslav Polyakov · Publicado 2003-12-31 · Atualizado 2017-07-29 · CVE-2003-1481

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions CommuniGate Pro versions 3.1 through 4.0.6

Description The issue allows remote attackers to hijack mail sessions. This can be achieved by sending an e-mail with an IMG tag that references a malicious URL, which captures the session ID sent in the referer field for an HTTP request for an image.

Recommendations For CommuniGate Pro versions 3.1 through 4.0.6, consider disabling the use of session IDs in HTTP requests until a patch is available. Restrict access to sensitive mail sessions to minimize the risk of exploitation. Avoid using IMG tags in e-mails that could potentially reference malicious URLs.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2003-1481

Produtos afetados

Communigate Pro

Referências · 7

• 🔥 http://securityfocus.com/bid/7501 · Exploit
• 🔥 https://exploit-db.com/exploits/27 · Exploit
• http://securityreason.com/securityalert/3290 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1481 · Nota
• http://securityfocus.com/archive/1/320438 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-1481 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11932 · Nota