6.5

CVE-2005-4558

Exploit

EPSS 11.95%
Published 28.12.2005 11:03:00
Last modified 03.04.2025 01:03:51
Source cve@mitre.org
Teams watchlist Login
Open Login

IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly restrict acceptable values for the language parameter to mail/settings.html before it is stored in a database, which can allow remote authenticated users to include arbitrary PHP code via a URL in a modified lang_settings parameter to mail/index.html.

Affected products Warnungen 0 Metrics 2 CWE 0 References 13

Data is provided by the National Vulnerability Database (NVD)

Deerfield ≫ Visnetic Mail Server Version8.3.0_build1

Icewarp ≫ Web Mail Version5.5.1

Merak ≫ Mail Server Version8.3.0r

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	11.95%	0.935

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.5	8	6.4	AV:N/AC:L/Au:S/C:P/I:P/A:P

http://marc.info/?l=full-disclosure&m=113570229524828&w=2

http://secunia.com/advisories/17046

Patch

Vendor Advisory

Exploit

http://secunia.com/advisories/17865

http://secunia.com/secunia_research/2005-62/advisory/

Vendor Advisory

Exploit

http://securitytracker.com/id?1015412

http://www.securityfocus.com/archive/1/420255/100/0/threaded

http://www.securityfocus.com/bid/16069

Exploit

http://www.osvdb.org/22080

http://www.osvdb.org/22081

https://exchange.xforce.ibmcloud.com/vulnerabilities/23904

https://nvd.nist.gov/vuln/detail/CVE-2005-4558

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2005-4558

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2005-4558

EUVD