PT-2005-1398 · Merak+1 · Merak Mail Server+1

Shineshadow · Published 2005-01-28 · Updated 2017-07-11 · CVE-2005-0320

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MERAK Mail Server version 7.6.0 with Icewarp Web Mail version 5.3.0

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters and fields, including the username parameter to "login.html", the accountid parameter to "accountsettings add.html", and the note, title, and location fields to "calendar.html".

Recommendations For MERAK Mail Server version 7.6.0 with Icewarp Web Mail version 5.3.0, consider disabling access to the "login.html", "accountsettings add.html", and "calendar.html" pages until a fix is available. Restrict the use of the username and accountid parameters, as well as the note, title, and location fields, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2005-0320

Affected Products

Icewarp Web Mail

Merak Mail Server

References · 6

• 🔥 https://exploit-db.com/exploits/25068 · Exploit
• 🔥 https://exploit-db.com/exploits/25069 · Exploit
• http://securityfocus.com/bid/12396 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0320 · Security Note
• http://marc.info/?l=bugtraq&m=110693950205007&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19147 · Note