IMail < 7.0.6 Account Hijacking

Medium Nessus Network Monitor Plugin ID 1507

Synopsis

The remote host is running the IMail web interface.

Description

The remote host is running the IMail web interface. There is a bug in the version being run which may allow an attacker to read the mailboxes of the users by sending them a malformed HTML email containing a link to an image hosted on a rogue web server.

Solution

Upgrade to IMail 7.0.6 or higher.

See Also

http://archives.neohapsis.com/archives/bugtraq/2001-10/0082.html

http://archives.neohapsis.com/archives/bugtraq/2002-03/0100.html

http://archives.neohapsis.com/archives/bugtraq/2002-03/0101.html

http://archives.neohapsis.com/archives/bugtraq/2002-03/0128.html

http://archives.neohapsis.com/archives/bugtraq/2002-03/0158.html

Plugin Details

Severity: Medium

ID: 1507

Family: Web Servers

Published: 2004/08/18

Modified: 2018/09/16

Dependencies: 1442

Nessus ID: 11271

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 5

Temporal Score: 4.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

CVSSv3

Base Score: 5.8

Temporal Score: 5.6

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Temporal Vector: CVSS3#E:X/RL:O/RC:C