PT-2001-2413 · Ipswitch · Ipswitch Imail

Published 2001-10-12 · Updated 2008-09-10 · CVE-2001-1286

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Ipswitch IMail versions 7.04 and earlier

Description: The issue allows remote attackers to hijack sessions by obtaining a URL that contains a user's session ID. This could be achieved via an HTML email that causes the Referrer to be sent to a URL under the attacker's control.

Recommendations: For Ipswitch IMail versions 7.04 and earlier, consider disabling the feature that stores session IDs in URLs as a temporary workaround until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of session hijacking. Avoid using URLs that contain session IDs in HTML emails or other potentially vulnerable communications.

Fix

Related Identifiers

CVE-2001-1286

Affected Products

Ipswitch Imail

References · 5

• http://online.securityfocus.com/archive/1/261096 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1286 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2001-10/0082.html · Note
• http://ipswitch.com/Support/IMail/news.html · Note
• http://securityfocus.com/bid/3432 · Note