PT-2004-2578 · Icewarp · Merak Mail Server

Shineshadow · Publicado 2004-10-12 · Atualizado 2017-07-11 · CVE-2004-1672

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Merak Mail Server version 7.4.5

Description The issue allows remote attackers to view other users' attachments by specifying the username and message ID in an HTTP request. This affects the attachment.html component in Merak Mail Server with Icewarp Web Mail.

Recommendations For Merak Mail Server version 7.4.5, consider restricting access to the attachment.html component until a patch is available. As a temporary workaround, avoid using the username and message ID parameters in HTTP requests to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2004-1672

Produtos afetados

Merak Mail Server

Referências · 5

• 🔥 http://secunia.com/advisories/12789 · Exploit
• http://marc.info/?l=bugtraq&m=109483971420067&w=2 · Nota
• http://securityfocus.com/bid/11371 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-1672 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17316 · Nota