Detections
Analytics
Atmail Webmail 3.x < 3.6.4 (3.64) Multiple Vulnerabilities
medium Nessus Plugin ID 73615
Language:
Synopsis
The remote web server contains an application that is affected by multiple vulnerabilities.Description
According to its version, the Atmail Webmail install on the remote host is 3.x prior to 3.6.4 (3.64). It is, therefore, potentially affected by the following vulnerabilities :- An input validation error exists related to the script 'showmail.pl' and the 'Folder' parameter that could allow unauthorized access to user mailboxes, or possibly SQL injection attacks and cross-site scripting attacks.
- Input validation errors exist in the scripts 'atmail.pl', 'search.pl', and 'reademail.pl' that could allow SQL injection attacks.
- An error exists related to the handling of session cookies that could allow authorized access to user mailboxes.
Solution
Upgrade to Atmail Webmail 3.6.4 (3.64) or later.See Also
Plugin Details
Severity: Medium
ID: 73615
File Name: atmail_webmail_3_64.nasl
Version: 1.8
Type: remote
Family: CGI abuses
Published: 4/18/2014
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:atmail:atmail
Required KB Items: www/atmail_webmail
Patch Publication Date: 12/9/2003
Vulnerability Publication Date: 12/9/2003