PT-2000-1649 · Alt N Technologies · Mdaemon

Published 2000-10-20 · Updated 2017-10-10 · CVE-2000-0716

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions MDaemon version 2.8

Description The issue concerns the WorldClient email client in MDaemon, where the session ID is included in the referer field of an HTTP request when a user clicks on a URL. This allows the visited website to potentially hijack the session ID and access the user's email.

Recommendations For MDaemon version 2.8, consider restricting access to external URLs from within the email client to minimize the risk of session ID hijacking until a fix is available.

Fix

Related Identifiers

CVE-2000-0716

Affected Products

Mdaemon

References · 5

• http://securityfocus.com/bid/1553 · Vendor Advisory
• http://ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0008&L=ntbugtraq&F=&S=&P=459 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2000-0716 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5070 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0716 · Note