PT-2004-2575 · Icewarp · Merak Mail Server

Shineshadow · Published 2004-09-10 · Updated 2017-07-11 · CVE-2004-1669

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MERAK Mail Server version 7.4.5

Description A cross-site scripting (XSS) issue allows remote attackers to execute arbitrary web script or HTML. This can be achieved via the User name parameter to "accountsettings.html" or the Search string parameter to "search.html".

Recommendations For MERAK Mail Server version 7.4.5, consider restricting access to the "accountsettings.html" and "search.html" endpoints until a patch is available. As a temporary workaround, avoid using the User name and Search string parameters in the affected endpoints.

Fix

Related Identifiers

CVE-2004-1669

Affected Products

Merak Mail Server

References · 5

• http://securityfocus.com/bid/11371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1669 · Security Note
• http://secunia.com/advisories/12789 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=109483971420067&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17313 · Note