PT-2001-2023 · Horde · Imp Webmail

Published 2001-12-06 · Updated 2017-10-10 · CVE-2001-0857

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Imp Webmail versions 2.2.6 and earlier

Description A cross-site scripting issue in the status.php3 file of Imp Webmail allows remote attackers to hijack session cookies and gain access to other users' email by exploiting the message parameter in a vulnerable API endpoint.

Recommendations For Imp Webmail versions 2.2.6 and earlier, consider disabling access to the status.php3 file until a patch is available to prevent exploitation of the cross-site scripting issue.

Exploit

Fix

Related Identifiers

CVE-2001-0857

Affected Products

Imp Webmail

References · 9

• 🔥 https://exploit-db.com/exploits/21151 · Exploit
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000437 · Vendor Advisory
• http://caldera.com/support/security/advisories/CSSA-2001-039.0.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-0857 · Security Note
• http://marc.info/?l=bugtraq&m=100535679608486&w=2 · Note
• http://osvdb.org/668 · Note
• http://marc.info/?l=bugtraq&m=100540578822469&w=2 · Note
• http://securityfocus.com/bid/3525 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7496 · Note