Lucene search

[email protected]CVE-2002-0490

HistoryAug 12, 2002 - 4:00 a.m.

CVE-2002-0490

2002-08-1204:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2002-0490

instant web mail

remote attack

security flaw

nvd

8.4 High

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.007 Low

EPSS

Percentile

80.1%

JSON

Instant Web Mail before 0.60 does not properly filter CR/LF sequences, which allows remote attackers to (1) execute arbitrary POP commands via the id parameter in message.php, or (2) modify certain mail message headers via numerous parameters in write.php.

CPENameOperatorVersion
instant_web_mail:instant_web_mailinstant web maileq0.59
instant_web_mail:instant_web_mailinstant web maileq0.56
instant_web_mail:instant_web_mailinstant web maileq0.55
instant_web_mail:instant_web_mailinstant web maileq0.58
instant_web_mail:instant_web_mailinstant web maileq0.57

CPE	Name	Operator	Version
instant_web_mail:instant_web_mail	instant web mail	eq	0.59
instant_web_mail:instant_web_mail	instant web mail	eq	0.56
instant_web_mail:instant_web_mail	instant web mail	eq	0.55
instant_web_mail:instant_web_mail	instant web mail	eq	0.58
instant_web_mail:instant_web_mail	instant web mail	eq	0.57

References

instantwebmail.sourceforge.net/#changeLog

www.iss.net/security_center/static/8650.php

www.securityfocus.com/archive/1/264041

www.securityfocus.com/bid/4361

8.4 High

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.007 Low

EPSS

Percentile

80.1%

JSON