Login Request a demo
Unscored severity · published Dec 28, 2005
CVE-2005-4559
mail/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly initialize the default_layout…
–
CVSS
8.6%
EPSS
No
On KEV
Description
mail/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly initialize the default_layout and layout_settings variables when an unrecognized HTTP_USER_AGENT string is provided, which allows remote attackers to access arbitrary files via a request with an unrecognized User Agent that also specifies the desired default_layout and layout_settings parameters.
Exploitation
Is it being used?
Exploit prediction (EPSS)8.6% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Mail Server · Merak
8.3.0r · source: NVD
VM
Visnetic Mail Server · Deerfield
8.3.0_build1 · source: NVD
WM
Web Mail · Icewarp
5.5.1 · source: NVD
Affected product
VM
Visnetic Mail Server
Deerfield
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-4559
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-4559
marc.info
http://marc.info/?l=full-disclosure&m=113570229524828&w=2
Patch
http://secunia.com/advisories/17046
secunia.com
http://secunia.com/advisories/17865
Vendor Advisory
http://secunia.com/secunia_research/2005-62/advisory/
securityreason.com
http://securityreason.com/securityalert/299
securitytracker.com
http://securitytracker.com/id?1015412
More from Visnetic Mail Server
–
CVE-2006-0817
Absolute path directory traversal vulnerability in (a) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (b) VisNetic MailServer before 8.5.0.5 allows…
–
CVE-2006-0818
Absolute path directory traversal vulnerability in (1) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (2) VisNetic MailServer before 8.5.0.5 allows…
–
CVE-2005-4556
PHP remote file include vulnerability in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, when register_globals is…
–
CVE-2005-4557
dir/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, allows remote attackers to include arbitrary local…
–
CVE-2005-4558
IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly restrict acceptable values for the language parameter…