PT-2003-2426 · Stalker · Communigate Pro

Yaroslav Polyakov · Published 2003-12-31 · Updated 2017-07-29 · CVE-2003-1481

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions CommuniGate Pro versions 3.1 through 4.0.6

Description The issue allows remote attackers to hijack mail sessions. This can be achieved by sending an e-mail with an IMG tag that references a malicious URL, which captures the session ID sent in the referer field for an HTTP request for an image.

Recommendations For CommuniGate Pro versions 3.1 through 4.0.6, consider disabling the use of session IDs in HTTP requests until a patch is available. Restrict access to sensitive mail sessions to minimize the risk of exploitation. Avoid using IMG tags in e-mails that could potentially reference malicious URLs.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2003-1481

Affected Products

Communigate Pro

References · 7

• 🔥 http://securityfocus.com/bid/7501 · Exploit
• 🔥 https://exploit-db.com/exploits/27 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1481 · Security Note
• http://securityreason.com/securityalert/3290 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1481 · Note
• http://securityfocus.com/archive/1/320438 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11932 · Note