CVE-2001-1211 Ipswitch IMail 7.0.4 and earlier allows attackers with administrator privileges to read and modify user alias and mailing list information for other domains hosted by the same server via the (1) alias...
HighCVSS 7.5
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Ipswitch IMail 7.0.4 and earlier allows attackers with administrator privileges to read and modify user alias and mailing list information for other domains hosted by the same server via the (1) aliasadmin or (2) listadm1 CGI programs, which do not properly verify that an administrator is the administrator for the target domain.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ipswitch imail | = 6.1 | No fix listed |
| ipswitch imail | = 6.2 | No fix listed |
| ipswitch imail | = 6.3 | No fix listed |
| ipswitch imail | = 6.4 | No fix listed |
| ipswitch imail | = 7.0.1 | No fix listed |
| ipswitch imail | = 7.0.2 | No fix listed |
| ipswitch imail | = 7.0.3 | No fix listed |
| ipswitch imail | = 7.0.4 | No fix listed |
References
- support.ipswitch.com
- support.ipswitch.com
- imail-admin-domain-change(7752) vdb-entry vendor-advisory
- 20011231 IMail Web Service User Aliases / Mailing Lists Admin Vulnerability mailing-list vendor-advisory
- 3766 vdb-entry vendor-advisory