PT-2005-2634 · Mercury · Mercur Messaging 2005 Sp2

Published 2005-05-18 · Updated 2008-09-05 · CVE-2005-1657

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mercur Messaging 2005 SP2

Description The issue allows remote attackers to perform unauthorized file operations. This can be achieved via several API endpoints, including (1) "deletefolder.ctml", (2) "deletemessage.ctml", (3) "origmessage.ctml", or (4) "readmessage.ctml" using the Folder.Id parameter, the "editmessage.ctml" endpoint using the Message.Id parameter, or the "messages.ctml" endpoint using the Message.Command parameter.

Recommendations For Mercur Messaging 2005 SP2, consider restricting access to the vulnerable API endpoints "deletefolder.ctml", "deletemessage.ctml", "origmessage.ctml", "readmessage.ctml", "editmessage.ctml", and "messages.ctml" to minimize the risk of exploitation. Avoid using the Folder.Id, Message.Id, and Message.Command parameters in these endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-1657

Affected Products

Mercur Messaging 2005 Sp2

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2005-1657 · Security Note
• http://osvdb.org/16221 · Note
• http://osvdb.org/16224 · Note
• http://osvdb.org/16225 · Note
• http://osvdb.org/16220 · Note
• http://osvdb.org/16223 · Note
• http://osvdb.org/16222 · Note
• http://secunia.com/advisories/15234 · Note