Alt-N WebAdmin < 3.0.3 Multiple Remote Vulnerabilities

medium Nessus Network Monitor Plugin ID 2572

Synopsis

The remote host is vulnerable to multiple attack vectors.

Description

The remote host is running Alt-N WebAdmin, a web interface to the MDaemon mail server. The remote version of this software is vulnerable to a cross-site scripting vulnerability due to a lack of filtering on user-supplied input in the file 'useredit_account.wdm' and the file 'modalframe.wdm'. An attacker may exploit this flaw to steal user credentials. This software is also vulnerable to an access bypass vulnerability in the file 'useredit_account.wdm'. An attacker may exploit this flaw to modify user account information. An attacker need a valid email account on the server to exploit both vulnerabilities.

Solution

Upgrade to WebAdmin 3.0.3 or higher.

Plugin Details

Severity: Medium

ID: 2572

Family: Web Servers

Published: 1/29/2005

Updated: 3/6/2019

Nessus ID: 16271

Risk Information

VPR

Risk Factor: Low

Score: 3.4

CVSS v2

Risk Factor: Medium

Base Score: 6

Temporal Score: 5.2

Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS v3

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:alt-n:webadmin

Reference Information

CVE: CVE-2005-0317, CVE-2005-0318, CVE-2005-0319

BID: 12395

Detections

Analytics