PT-2005-2634 · Mercury · Mercur Messaging 2005 Sp2

Publicado 2005-05-18 · Atualizado 2008-09-05 · CVE-2005-1657

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mercur Messaging 2005 SP2

Description The issue allows remote attackers to perform unauthorized file operations. This can be achieved via several API endpoints, including (1) "deletefolder.ctml", (2) "deletemessage.ctml", (3) "origmessage.ctml", or (4) "readmessage.ctml" using the Folder.Id parameter, the "editmessage.ctml" endpoint using the Message.Id parameter, or the "messages.ctml" endpoint using the Message.Command parameter.

Recommendations For Mercur Messaging 2005 SP2, consider restricting access to the vulnerable API endpoints "deletefolder.ctml", "deletemessage.ctml", "origmessage.ctml", "readmessage.ctml", "editmessage.ctml", and "messages.ctml" to minimize the risk of exploitation. Avoid using the Folder.Id, Message.Id, and Message.Command parameters in these endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-1657

Produtos afetados

Mercur Messaging 2005 Sp2

Referências · 8

• http://osvdb.org/16221 · Nota
• http://osvdb.org/16224 · Nota
• http://osvdb.org/16225 · Nota
• http://osvdb.org/16220 · Nota
• http://osvdb.org/16223 · Nota
• http://osvdb.org/16222 · Nota
• http://secunia.com/advisories/15234 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1657 · Nota de Segurança