PT-2004-2624 · Icewarp · Merak Mail Server

Publicado 2004-08-17 · Atualizado 2017-07-11 · CVE-2004-1720

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Merak Mail Server version 5.2.7

Description The issue allows remote attackers to gain sensitive information via an invalid HTTP request, which reveals the installation path. This is possible through the address.html page and possibly the calendar.html page, although the latter's exposure is unclear as the path may be leaked in web logs only accessible to administrators.

Recommendations For Merak Mail Server version 5.2.7, consider restricting access to the address.html page and potentially the calendar.html page until a fix is available. As a temporary workaround, limit the information revealed in web logs to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2004-1720

Produtos afetados

Merak Mail Server

Referências · 9

• 🔥 https://exploit-db.com/exploits/24381 · Exploit
• 🔥 http://packetstormsecurity.nl/0408-exploits/merak527.txt · Exploit
• 🔥 http://secunia.com/advisories/12269 · Exploit
• 🔥 http://securityfocus.com/bid/10966 · Exploit
• 🔥 http://osvdb.org/9043 · Exploit
• http://securitytracker.com/id?1010969 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17027 · Nota
• http://marc.info/?l=bugtraq&m=109279057326044&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1720 · Nota de Segurança