Multiple cross-site scripting (XSS) vulnerabilities in Merak Webmail Server 5.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) category, (2) cserver, (3) ext, (4) global, (5) showgroups, (6) or showlite parameters to address.html, or the (7) spage or (8) autoresponder parameters to settings.html, the (9) folder parameter to readmail.html, or the (10) attachmentpage_text_error parameter to attachment.html, (11) folder, (12) ct, or (13) cv parameters to calendar.html, (14) an <img> tag, or (15) the subject of an e-mail message.

The target is running at least one instance of Merak Webmail / IceWarp Web Mail 5.2.7 or less or Merak Mail Server 7.5.2 or less.  Such versions are potentially affected by multiple cross-site scripting, HTML and SQL injection, and PHP source code disclosure vulnerabilities.

The remote host is running Merak Mail Server. It is reported that versions prior to 7.5.1 are prone to multiple vulnerabilities in the Web Mail module. An attacker may use these vulnerabilities to perform cross-site scripting attacks, SQL injection and access to the PHP source code.

ID	Name	Product	Family	Severity
14379	Merak Webmail / IceWarp Web Mail < 5.2.8 Multiple Vulnerabilities	Nessus	CGI abuses	high
2158	Merak Mail Server < 7.5.2 Web Mail Module Multiple Vulnerabilities	Nessus Network Monitor	IMAP Servers	high
2157	Merak Mail Server < 7.5.2 Web Mail Module Multiple Vulnerabilities	Nessus Network Monitor	SMTP Servers	high
2156	Merak Mail Server < 7.5.1 Web Mail Module Multiple Vulnerabilities	Nessus Network Monitor	POP Server	high

Detections

Analytics

CVE-2004-1719

medium

Tenable Plugins

high

high

high

high