PT-2004-2579 · Icewarp · Icewarp Web Mail+1

Shineshadow · Published 2004-10-12 · Updated 2017-07-11 · CVE-2004-1673

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Merak Mail Server version 7.4.5

Description The issue allows remote attackers to create text files with arbitrary content. This is achieved via the accountid parameter in the "accountsettings add.html" page, potentially affecting Icewarp Web Mail version 5.2.7 and possibly other versions.

Recommendations For Merak Mail Server version 7.4.5, consider restricting access to the "accountsettings add.html" page to minimize the risk of exploitation. Avoid using the accountid parameter in this page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2004-1673

Affected Products

Icewarp Web Mail

Merak Mail Server

References · 5

• 🔥 http://secunia.com/advisories/12789 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1673 · Security Note
• http://securityfocus.com/bid/11371 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17317 · Note
• http://marc.info/?l=bugtraq&m=109483971420067&w=2 · Note