PT-2001-2345 · Ipswitch · Ipswitch Imail

Published 2001-12-31 · Updated 2008-09-05 · CVE-2001-1211

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ipswitch IMail versions 7.0.4 and earlier

Description The issue allows attackers with administrator privileges to read and modify user alias and mailing list information for other domains hosted by the same server. This is due to the aliasadmin or listadm1 CGI programs not properly verifying that an administrator is the administrator for the target domain.

Recommendations For Ipswitch IMail versions 7.0.4 and earlier, consider restricting access to the aliasadmin and listadm1 CGI programs until a proper fix is available. As a temporary workaround, ensure that only trusted administrators have access to these programs to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2001-1211

Affected Products

Ipswitch Imail

References · 6

• http://securityfocus.com/archive/1/247786 · Vendor Advisory
• http://iss.net/security_center/static/7752.php · Vendor Advisory
• http://securityfocus.com/bid/3766 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1211 · Security Note
• http://support.ipswitch.com/kb/IM-20011219-DM01.htm · Note
• http://support.ipswitch.com/kb/IM-20020301-DM02.htm · Note