PT-2004-3594 · Hastymail+1 · Hastymail+1

Publicado 2004-12-31 · Atualizado 2021-07-23 · CVE-2004-2704

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Hastymail versions 1.0.1 and earlier Hastymail development versions 1.1 and earlier

Description The issue allows attachments to be rendered inline by Internet Explorer, potentially facilitating cross-site scripting (XSS) and other attacks, due to the absence of the attachment parameter in the Content-Disposition field for attachments.

Recommendations For Hastymail versions 1.0.1 and earlier, consider updating to a version that includes the attachment parameter in the Content-Disposition field to prevent inline rendering of attachments. For Hastymail development versions 1.1 and earlier, consider updating to a version that includes the attachment parameter in the Content-Disposition field to prevent inline rendering of attachments. As a temporary workaround, consider configuring Internet Explorer to not render attachments inline, or avoid using Internet Explorer to access attachments from Hastymail until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2004-2704

Produtos afetados

Hastymail

Internet Explorer

Referências · 8

• http://archives.neohapsis.com/archives/bugtraq/2004-08/0322.html · Nota
• http://securitytracker.com/id?1011054 · Nota
• http://securityfocus.com/bid/11022 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17091 · Nota
• http://osvdb.org/9131 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2704 · Nota de Segurança
• http://secunia.com/advisories/12358 · Aviso do Fabricante
• http://hastymail.sourceforge.net/security.php · Correção