PT-2004-3594 · Hastymail+1 · Hastymail+1

Published 2004-12-31 · Updated 2021-07-23 · CVE-2004-2704

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Hastymail versions 1.0.1 and earlier Hastymail development versions 1.1 and earlier

Description The issue allows attachments to be rendered inline by Internet Explorer, potentially facilitating cross-site scripting (XSS) and other attacks, due to the absence of the attachment parameter in the Content-Disposition field for attachments.

Recommendations For Hastymail versions 1.0.1 and earlier, consider updating to a version that includes the attachment parameter in the Content-Disposition field to prevent inline rendering of attachments. For Hastymail development versions 1.1 and earlier, consider updating to a version that includes the attachment parameter in the Content-Disposition field to prevent inline rendering of attachments. As a temporary workaround, consider configuring Internet Explorer to not render attachments inline, or avoid using Internet Explorer to access attachments from Hastymail until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2004-2704

Affected Products

Hastymail

Internet Explorer

References · 8

• http://securityfocus.com/bid/11022 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-2704 · Security Note
• http://secunia.com/advisories/12358 · Vendor Advisory
• http://hastymail.sourceforge.net/security.php · Patch
• http://archives.neohapsis.com/archives/bugtraq/2004-08/0322.html · Note
• http://securitytracker.com/id?1011054 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17091 · Note
• http://osvdb.org/9131 · Note