PT-2004-3273 · @Mail · Mail

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2379

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: @Mail version 3.64

Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific attributes, including the Displayed Name attribute in util.pl and the Folder attribute in showmail.pl.

Recommendations: For @Mail version 3.64, consider disabling the util.pl and showmail.pl scripts until a patch is available to prevent exploitation of the XSS vulnerabilities via the Displayed Name and Folder attributes. Restrict access to these scripts to minimize the risk of arbitrary web script or HTML injection.

Exploit

Fix

Related Identifiers

CVE-2004-2379

Affected Products

Mail

References · 10

• 🔥 http://securitytracker.com/alerts/2004/Feb/1009208.html · Exploit
• 🔥 http://members.lycos.co.uk/r34ct/main/@mail_3.64/@mail_3.64.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2379 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2379 · Note
• http://secunia.com/advisories/10978 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15324 · Note
• http://osvdb.org/4066 · Note
• http://securityfocus.com/bid/9748 · Note
• http://osvdb.org/4067 · Note
• http://members.lycos.co.uk/r34ct/main/%40mail_3.64/%40mail_3.64.txt · Note