CVE-2006-4952 The updatemail servlet in Neon WebMail for Java before 5.08 allows remote attackers to move e-mail messages of arbitrary users between different mail folders, specified by the folderid and tofolderid....
HighCVSS 7.5
EPSS 8.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The updatemail servlet in Neon WebMail for Java before 5.08 allows remote attackers to move e-mail messages of arbitrary users between different mail folders, specified by the folderid and tofolderid parameters, via the ID parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| neosys neon webmail | = 5.06 | No fix listed |
| neosys neon webmail | = 5.07 | No fix listed |
References
- 22029 patch third-party-advisory vendor-advisory
- vuln.sg exploit patch
- 20109 exploit patch vdb-entry
- 84202 vdb-entry
- neonwebmail-updatemail-insecure-data(29087) vdb-entry