PT-2005-1398 · Merak+1 · Merak Mail Server+1

Shineshadow · Publicado 2005-01-28 · Atualizado 2017-07-11 · CVE-2005-0320

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MERAK Mail Server version 7.6.0 with Icewarp Web Mail version 5.3.0

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters and fields, including the username parameter to "login.html", the accountid parameter to "accountsettings add.html", and the note, title, and location fields to "calendar.html".

Recommendations For MERAK Mail Server version 7.6.0 with Icewarp Web Mail version 5.3.0, consider disabling access to the "login.html", "accountsettings add.html", and "calendar.html" pages until a fix is available. Restrict the use of the username and accountid parameters, as well as the note, title, and location fields, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Identificadores relacionados

CVE-2005-0320

Produtos afetados

Icewarp Web Mail

Merak Mail Server

Referências · 6

• 🔥 https://exploit-db.com/exploits/25068 · Exploit
• 🔥 https://exploit-db.com/exploits/25069 · Exploit
• http://securityfocus.com/bid/12396 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=110693950205007&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0320 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19147 · Nota