PT-2006-7302 · @Mail · @Mail Webmail

Philippe C. Caturegli · Publicado 2006-12-23 · Atualizado 2018-10-17 · CVE-2006-6701

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: @Mail WebMail versions 4.51 @Mail WebMail versions 5.x before 5.03

Description: A cross-site request forgery issue allows remote attackers to modify arbitrary settings and perform unauthorized actions as an arbitrary user. This can be achieved by using a settings action in the SRC attribute of an IMG element in an HTML e-mail.

Recommendations: For @Mail WebMail version 4.51, update to a version that contains a fix for this issue. For @Mail WebMail versions 5.x before 5.03, update to version 5.03 or later.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2006-6701

Produtos afetados

@Mail Webmail

Referências · 12

• http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0512.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6701 · Nota
• http://netragard.com/pdfs/research/ATMAIL-XSRF-ADVISORY-20061206.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6701 · Nota de Segurança
• http://vupen.com/english/advisories/2007/1864 · Nota
• http://netragard.com/html/recent_research.html · Nota
• http://secunia.com/advisories/23472 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31259 · Nota
• http://securityfocus.com/archive/1/458109/100/100/threaded · Nota
• http://terra.calacode.com/mail/docs/changelog.html · Nota
• http://secunia.com/advisories/25328 · Aviso do Fabricante
• http://securitytracker.com/id?1017435 · Nota