PT-2006-7302 · @Mail · @Mail Webmail

Philippe C. Caturegli · Published 2006-12-23 · Updated 2018-10-17 · CVE-2006-6701

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: @Mail WebMail versions 4.51 @Mail WebMail versions 5.x before 5.03

Description: A cross-site request forgery issue allows remote attackers to modify arbitrary settings and perform unauthorized actions as an arbitrary user. This can be achieved by using a settings action in the SRC attribute of an IMG element in an HTML e-mail.

Recommendations: For @Mail WebMail version 4.51, update to a version that contains a fix for this issue. For @Mail WebMail versions 5.x before 5.03, update to version 5.03 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2006-6701

Affected Products

@Mail Webmail

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2006-6701 · Security Note
• http://secunia.com/advisories/23472 · Vendor Advisory
• http://secunia.com/advisories/25328 · Vendor Advisory
• http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0512.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6701 · Note
• http://netragard.com/pdfs/research/ATMAIL-XSRF-ADVISORY-20061206.txt · Note
• http://vupen.com/english/advisories/2007/1864 · Note
• http://netragard.com/html/recent_research.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31259 · Note
• http://securityfocus.com/archive/1/458109/100/100/threaded · Note
• http://terra.calacode.com/mail/docs/changelog.html · Note
• http://securitytracker.com/id?1017435 · Note