A vulnerability was found in Merak Mail Server 8.0.3 (Mail Server Software). It has been rated as problematic. Affected by this issue is some unknown functionality of the file attachment.html. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. CVE summarizes:

merak mail server 8.0.3 with icewarp web mail 5.4.2 when the mailbox.dat file does not exist allows remote authenticated users to determine if a file exists via the folder parameter to attachment.html.

The weakness was presented 05/11/2005 as not defined posting (Bugtraq). The advisory is available at marc.theaimsgroup.com. This vulnerability is handled as CVE-2005-1490 since 05/11/2005. The exploitation is known to be easy. Local access is required to approach this attack. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

By approaching the search of inurl:attachment.html it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at X-Force (20472). See 25119, 25117 and 25116 for similar entries.

Productinfo

Type

• Mail Server Software

Vendor

• Merak

Name

• Mail Server

Version

• 8.0.3

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion