PT-2005-4226 · Rockliffe · Rockliffe Mailsite Express

Paul Craig · Publicado 2005-11-02 · Atualizado 2017-07-11 · CVE-2005-3430

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Rockliffe MailSite Express versions prior to 6.1.22

Description The issue allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions, such as .unk, .asa, and possibly .htr and .aspx, which are not filtered like the .asp extension.

Recommendations For versions prior to 6.1.22, update to version 6.1.22 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to only necessary extensions to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-3430

Produtos afetados

Rockliffe Mailsite Express

Referências · 9

• http://security-assessment.com/Advisories/Rockliffe_Express_Webmail_Vulnerabilities.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-3430 · Nota de Segurança
• http://securitytracker.com/id?1015117 · Nota
• http://secunia.com/advisories/17240 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=113053680631151&w=2 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3430 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22907 · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0578.html · Correção
• http://securityfocus.com/bid/15230 · Nota