PT-2000-1887 · Mailfile · Mailfile

Published 2000-12-19 · Updated 2017-10-10 · CVE-2000-0977

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions MailFile version 1.10

Description The issue allows remote attackers to read arbitrary files by specifying the target file name in the filename parameter in a POST request. This request is then sent by email to the address specified in the email parameter.

Recommendations For MailFile version 1.10, consider restricting access to the mailfile.cgi CGI program until a patch is available, or avoid using the filename parameter in the affected POST request to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2000-0977

Affected Products

Mailfile

References · 5

• 🔥 http://securityfocus.com/bid/1807 · Exploit
• 🔥 https://exploit-db.com/exploits/20303 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2000-10/0172.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2000-0977 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5358 · Note