CVE-2005-4558

IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly restrict acceptable values for the language parameter to mail/settings.html before it is stored in a database, which can allow remote authenticated users to include arbitrary PHP code via a URL in a modified lang_settings parameter to mail/index.html.

CVSS v2.0 6.5 MEDIUM

6.5^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/secunia_research/2005-62/advisory/	Exploit Vendor Advisory
http://www.securityfocus.com/bid/16069	Exploit
http://secunia.com/advisories/17046	Exploit Patch Vendor Advisory
http://secunia.com/advisories/17865
http://securitytracker.com/id?1015412
http://www.osvdb.org/22080
http://www.osvdb.org/22081
http://marc.info/?l=full-disclosure&m=113570229524828&w=2
https://exchange.xforce.ibmcloud.com/vulnerabilities/23904
http://www.securityfocus.com/archive/1/420255/100/0/threaded

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:merak:mail_server:8.3.0r:::::::*
	cpe:2.3:a:deerfield:visnetic_mail_server:8.3.0_build1:::::::*
	cpe:2.3:a:icewarp:web_mail:5.5.1:::::::*

Information

Published : 2005-12-28 03:03

Updated : 2018-10-19 08:41

NVD link : CVE-2005-4558

Mitre link : CVE-2005-4558

JSON object : View

CWE

NVD-CWE-Other

Products Affected

merak

mail_server

icewarp

web_mail

deerfield

visnetic_mail_server

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://secunia.com/secunia_research/2005-62/advisory/", "name": "http://secunia.com/secunia_research/2005-62/advisory/", "tags": ["Exploit", "Vendor Advisory"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/16069", "name": "16069", "tags": ["Exploit"], "refsource": "BID"}, {"url": "http://secunia.com/advisories/17046", "name": "17046", "tags": ["Exploit", "Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://secunia.com/advisories/17865", "name": "17865", "tags": [], "refsource": "SECUNIA"}, {"url": "http://securitytracker.com/id?1015412", "name": "1015412", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.osvdb.org/22080", "name": "22080", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.osvdb.org/22081", "name": "22081", "tags": [], "refsource": "OSVDB"}, {"url": "http://marc.info/?l=full-disclosure&m=113570229524828&w=2", "name": "20051227 Secunia Research: IceWarp Web Mail Multiple File", "tags": [], "refsource": "FULLDISC"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23904", "name": "visnetic-settings-file-include(23904)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/420255/100/0/threaded", "name": "20051227 Secunia Research: IceWarp Web Mail Multiple File InclusionVulnerabilities", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly restrict acceptable values for the language parameter to mail/settings.html before it is stored in a database, which can allow remote authenticated users to include arbitrary PHP code via a URL in a modified lang_settings parameter to mail/index.html."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2005-4558", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2005-12-28T11:03Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:merak:mail_server:8.3.0r:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:deerfield:visnetic_mail_server:8.3.0_build1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:icewarp:web_mail:5.5.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-19T15:41Z"}

6.5 /10