PT-2009-3969 · Icewarp · Icewarp Mail Server

Publicado 2009-05-05 · Atualizado 2018-10-10 · CVE-2009-1468

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IceWarp eMail Server and WebMail Server versions prior to 9.4.2

Description The issue concerns SQL injection vulnerabilities in the search form of the Groupware component. These vulnerabilities allow remote authenticated users to execute arbitrary SQL commands. The vulnerabilities are specifically related to the sql and order by elements in an XML search query.

Recommendations For versions prior to 9.4.2, update to version 9.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the search form in the Groupware component until the update is applied.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2009-1468

Produtos afetados

Icewarp Mail Server

Referências · 8

• 🔥 https://exploit-db.com/exploits/32968 · Exploit
• 🔥 http://securityfocus.com/bid/34820 · Exploit
• 🔥 http://redteam-pentesting.de/advisories/rt-sa-2009-003 · Exploit
• http://vupen.com/english/advisories/2009/1253 · Nota
• http://securitytracker.com/id?1022169 · Nota
• http://securityfocus.com/archive/1/503226/100/0/threaded · Nota
• http://osvdb.org/54228 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-1468 · Nota de Segurança