Alt-N WebAdmin < 3.0.3 Multiple Remote Vulnerabilities

Medium Nessus Network Monitor Plugin ID 2572

Synopsis

The remote host is vulnerable to multiple attack vectors.

Description

The remote host is running Alt-N WebAdmin, a web interface to the MDaemon mail server. The remote version of this software is vulnerable to a cross-site scripting vulnerability due to a lack of filtering on user-supplied input in the file 'useredit_account.wdm' and the file 'modalframe.wdm'. An attacker may exploit this flaw to steal user credentials. This software is also vulnerable to an access bypass vulnerability in the file 'useredit_account.wdm'. An attacker may exploit this flaw to modify user account information. An attacker need a valid email account on the server to exploit both vulnerabilities.

Solution

Upgrade to WebAdmin 3.0.3 or higher.

See Also

http://archives.neohapsis.com/archives/bugtraq/2005-01/0313.html

Plugin Details

Severity: Medium

ID: 2572

File Name: 2572.prm

Family: Web Servers

Published: 2005/01/29

Modified: 2016/02/05

Dependencies: 1442

Nessus ID: 16271

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 6

Temporal Score: 5.2

Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

CVSSv3

Base Score: 5

Temporal Score: 4.8

Vector: CVSS3#AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS3#E:H/RL:O/RC:C

Reference Information

CVE: CVE-2005-0319, CVE-2005-0317, CVE-2005-0318

BID: 12395

OSVDB: 13322, 13323, 13324