PT-2009-6476 · Transware · Transware Active! Mail

Kenichi Maehashi · Publicado 2009-12-17 · Atualizado 2017-08-17 · CVE-2009-4353

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions TransWARE Active! mail 2003 versions 2003.0139.0871 and earlier

Description The issue allows remote attackers to hijack web sessions via vectors such as an email with an embedded URL, due to the failure to remove the session ID in a Referer URL.

Recommendations For TransWARE Active! mail 2003 versions 2003.0139.0871 and earlier, consider disabling the use of Referer URLs until a patch is available to remove the session ID and prevent web session hijacking.

Correção

Identificadores relacionados

CVE-2009-4353

Produtos afetados

Transware Active! Mail

Referências · 6

• http://transware.co.jp/support_am/security/vulnerability3.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54751 · Nota
• http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000076.html · Nota
• http://secunia.com/advisories/37602 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-4353 · Nota de Segurança
• http://jvn.jp/en/jp/JVN85821104/index.html · Nota