PT-2005-2726 · Oracle+1 · Javamail Api+1

Ricky Latt · Published 2005-12-31 · Updated 2024-08-07 · CVE-2005-1754

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JavaMail API versions 1.1.3 through 1.3

Description The issue allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter. It is worth noting that Sun and Apache dispute this issue, with Sun stating that the report references non-existent source code and files in the mentioned products.

Recommendations For JavaMail API versions 1.1.3 through 1.3, as a temporary workaround, consider restricting access to the Download parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2020-3213

ALT-PU-2021-2858

CVE-2005-1754

Affected Products

Alt Linux

Javamail Api

References · 65

• 🔥 https://github.com/RedTeamPentesting/CVE-2020-13935 · Exploit
• 🔥 https://github.com/nibiwodong/CNVD-2020-10487-Tomcat-ajp-POC · Exploit
• 🔥 https://github.com/sgdream/CVE-2020-1938 · Exploit
• 🔥 https://github.com/xindongzhuaizhuai/CVE-2020-1938 · Exploit
• 🔥 https://github.com/sv3nbeast/CVE-2020-1938-Tomact-file_include-file_read · Exploit
• 🔥 https://github.com/laolisafe/CVE-2020-1938 · Exploit
• 🔥 https://github.com/Hancheng-Lei/Hacking-Vulnerability-CVE-2020-1938-Ghostcat · Exploit
• 🔥 https://github.com/fairyming/CVE-2020-1938 · Exploit
• 🔥 https://github.com/dacade/CVE-2020-1938 · Exploit
• 🔥 https://github.com/woaiqiukui/CVE-2020-1938TomcatAjpScanner · Exploit
• 🔥 https://github.com/fatal0/tomcat-cve-2020-1938-check · Exploit
• 🔥 https://github.com/w4fz5uck5/CVE-2020-1938-Clean-Version · Exploit
• 🔥 https://github.com/rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996 · Exploit
• 🔥 https://github.com/Just1ceP4rtn3r/CVE-2020-1938-Tool · Exploit
• 🔥 https://github.com/YounesTasra-R4z3rSw0rd/CVE-2020-1938 · Exploit