Vulnerability CVE-2005-3430
Published: 2005-11-02   Modified: 2012-02-12

Description:
Incomplete blacklist vulnerability in Rockliffe MailSite Express before 6.1.22 allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions, such as (1) .unk, (2) .asa, and possibly (3) .htr and (4) .aspx, which are not filtered like the .asp extension.

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Rockliffe -> Mailsite express 

 References:
http://www.security-assessment.com/Advisories/Rockliffe_Express_Webmail_Vulnerabilities.pdf
http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0578.html
http://xforce.iss.net/xforce/xfdb/22907
http://www.securityfocus.com/bid/15230
http://securitytracker.com/id?1015117
http://secunia.com/advisories/17240/
http://marc.theaimsgroup.com/?l=bugtraq&m=113053680631151&w=2
Copyright 2024, cxsecurity.com

 

Back to Top