PT-2004-2578 · Icewarp · Merak Mail Server

Shineshadow · Published 2004-10-12 · Updated 2017-07-11 · CVE-2004-1672

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Merak Mail Server version 7.4.5

Description The issue allows remote attackers to view other users' attachments by specifying the username and message ID in an HTTP request. This affects the attachment.html component in Merak Mail Server with Icewarp Web Mail.

Recommendations For Merak Mail Server version 7.4.5, consider restricting access to the attachment.html component until a patch is available. As a temporary workaround, avoid using the username and message ID parameters in HTTP requests to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2004-1672

Affected Products

Merak Mail Server

References · 5

• 🔥 http://secunia.com/advisories/12789 · Exploit
• http://securityfocus.com/bid/11371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1672 · Security Note
• http://marc.info/?l=bugtraq&m=109483971420067&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17316 · Note