CVE-2004-2547 NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to obtain sensitive information via HTTP requests that (a) specify the / URI, (b) specify the /scripts/ URI, or (c) specify a no...
LowCVSS 2.6
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to obtain sensitive information via HTTP requests that (a) specify the / URI, (b) specify the /scripts/ URI, or (c) specify a non-existent file, which reveal the path in an error message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netwin surgemail | = 1.0c | No fix listed |
| netwin surgemail | = 1.0d | No fix listed |
| netwin surgemail | = 1.1a | No fix listed |
| netwin surgemail | = 1.1b | No fix listed |
| netwin surgemail | = 1.1c | No fix listed |
| netwin surgemail | = 1.1d | No fix listed |
| netwin surgemail | = 1.2a | No fix listed |
| netwin surgemail | = 1.2b | No fix listed |
| netwin surgemail | = 1.2c | No fix listed |
| netwin surgemail | = 1.3a | No fix listed |
| netwin surgemail | = 1.3a_rc1 | No fix listed |
| netwin surgemail | = 1.3b | No fix listed |
| netwin surgemail | = 1.3c | No fix listed |
| netwin surgemail | = 1.3d | No fix listed |
| netwin surgemail | = 1.3e | No fix listed |
| netwin surgemail | = 1.3f | No fix listed |
| netwin surgemail | = 1.3g | No fix listed |
| netwin surgemail | = 1.3h | No fix listed |
| netwin surgemail | = 1.3i | No fix listed |
| netwin surgemail | = 1.3j | No fix listed |
| netwin surgemail | = 1.3k | No fix listed |
| netwin surgemail | = 1.3l | No fix listed |
| netwin surgemail | = 1.4a | No fix listed |
| netwin surgemail | = 1.4b | No fix listed |
| netwin surgemail | = 1.4c | No fix listed |
Show 21 more
| Product | Affected versions | Fixed in |
|---|---|---|
| netwin surgemail | = 1.5a | No fix listed |
| netwin surgemail | = 1.5b | No fix listed |
| netwin surgemail | = 1.5c | No fix listed |
| netwin surgemail | = 1.5d | No fix listed |
| netwin surgemail | = 1.5d2 | No fix listed |
| netwin surgemail | = 1.5f | No fix listed |
| netwin surgemail | = 1.6a | No fix listed |
| netwin surgemail | = 1.6b | No fix listed |
| netwin surgemail | = 1.6d | No fix listed |
| netwin surgemail | = 1.6e | No fix listed |
| netwin surgemail | = 1.6e2 | No fix listed |
| netwin surgemail | = 1.7a | No fix listed |
| netwin surgemail | = 1.7b3 | No fix listed |
| netwin surgemail | = 1.8a | No fix listed |
| netwin surgemail | = 1.8b3 | No fix listed |
| netwin surgemail | = 1.8d | No fix listed |
| netwin surgemail | = 1.8e | No fix listed |
| netwin surgemail | = 1.8g3 | No fix listed |
| netwin surgemail | = 1.9b2 | No fix listed |
| netwin surgemail | = 2.0a2 | No fix listed |
| netwin webmail | = 3.1d | No fix listed |
References
- 20040603 Surgemail - Multiple Vulnerabilities exploit mailing-list patch
- 11772 patch third-party-advisory vendor-advisory
- www.exploitlabs.com exploit patch
- www.netwinsite.com patch
- 6745 exploit patch vdb-entry
- 10483 exploit patch vdb-entry
- surgemail-invalid-path-disclosure(16319) vdb-entry