PT-2004-2579 · Icewarp · Icewarp Web Mail+1

Shineshadow · Publicado 2004-10-12 · Atualizado 2017-07-11 · CVE-2004-1673

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Merak Mail Server version 7.4.5

Description The issue allows remote attackers to create text files with arbitrary content. This is achieved via the accountid parameter in the "accountsettings add.html" page, potentially affecting Icewarp Web Mail version 5.2.7 and possibly other versions.

Recommendations For Merak Mail Server version 7.4.5, consider restricting access to the "accountsettings add.html" page to minimize the risk of exploitation. Avoid using the accountid parameter in this page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2004-1673

Produtos afetados

Icewarp Web Mail

Merak Mail Server

Referências · 5

• 🔥 http://secunia.com/advisories/12789 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1673 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17317 · Nota
• http://marc.info/?l=bugtraq&m=109483971420067&w=2 · Nota
• http://securityfocus.com/bid/11371 · Aviso do Fabricante