PT-2004-3273 · @Mail · Mail

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2379

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: @Mail version 3.64

Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific attributes, including the Displayed Name attribute in util.pl and the Folder attribute in showmail.pl.

Recommendations: For @Mail version 3.64, consider disabling the util.pl and showmail.pl scripts until a patch is available to prevent exploitation of the XSS vulnerabilities via the Displayed Name and Folder attributes. Restrict access to these scripts to minimize the risk of arbitrary web script or HTML injection.

Exploit

Correção

Identificadores relacionados

CVE-2004-2379

Produtos afetados

Mail

Referências · 10

• 🔥 http://securitytracker.com/alerts/2004/Feb/1009208.html · Exploit
• 🔥 http://members.lycos.co.uk/r34ct/main/@mail_3.64/@mail_3.64.txt · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2379 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2379 · Nota de Segurança
• http://secunia.com/advisories/10978 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15324 · Nota
• http://osvdb.org/4066 · Nota
• http://securityfocus.com/bid/9748 · Nota
• http://osvdb.org/4067 · Nota
• http://members.lycos.co.uk/r34ct/main/%40mail_3.64/%40mail_3.64.txt · Nota