PT-2005-2287 · Argosoft · Argosoft Mail Server Pro

Shineshadow · Published 2005-04-26 · Updated 2017-07-11 · CVE-2005-1284

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Argosoft Mail Server Pro version 1.8.7.6

Description: The issue allows remote attackers to create arbitrary accounts in Argosoft Mail Server Pro, even when the "Allow Creation of Accounts From the Web Interface" option is disabled. This can be achieved via a direct HTTP POST request to the addnew script.

Recommendations: For Argosoft Mail Server Pro version 1.8.7.6, consider disabling the addnew script until a patch is available to prevent remote attackers from creating arbitrary accounts. Restrict access to the web interface to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-1284

Affected Products

Argosoft Mail Server Pro

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2005-1284 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1284 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/20228 · Note
• http://securityfocus.com/bid/13323 · Note
• http://osvdb.org/15822 · Note
• http://marc.info/?l=bugtraq&m=111419001527077&w=2 · Note