PT-2005-2287 · Argosoft · Argosoft Mail Server Pro

Shineshadow · Publicado 2005-04-26 · Atualizado 2017-07-11 · CVE-2005-1284

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Argosoft Mail Server Pro version 1.8.7.6

Description: The issue allows remote attackers to create arbitrary accounts in Argosoft Mail Server Pro, even when the "Allow Creation of Accounts From the Web Interface" option is disabled. This can be achieved via a direct HTTP POST request to the addnew script.

Recommendations: For Argosoft Mail Server Pro version 1.8.7.6, consider disabling the addnew script until a patch is available to prevent remote attackers from creating arbitrary accounts. Restrict access to the web interface to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-1284

Produtos afetados

Argosoft Mail Server Pro

Referências · 6

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1284 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1284 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20228 · Nota
• http://securityfocus.com/bid/13323 · Nota
• http://osvdb.org/15822 · Nota
• http://marc.info/?l=bugtraq&m=111419001527077&w=2 · Nota