PT-2018-8256 · Apache · Apache Pony Mail

Publicado 2018-10-04 · Atualizado 2019-01-08 · CVE-2017-5658

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Pony Mail versions 0.7 through 0.9

Description: The statistics generator in Apache Pony Mail was found to be returning timestamp data without proper authorization checks, potentially leading to derived information disclosure on private lists about the timing of specific email subjects or text bodies. This issue was primarily related to a caching feature used for faster loading times, which was disabled by default to prevent this.

Recommendations: For Apache Pony Mail versions 0.7 through 0.9, upgrade to version 0.10 to address this issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-5658

Produtos afetados

Apache Pony Mail

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-5658 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-5658 · Aviso do Fabricante
• https://lists.apache.org/thread.html/6a18cf5690d54231836f277f2b4346b53da3b6b6b08fee4c4ef4977e%40%3Cdev.ponymail.apache.org%3E · Nota