Vulnerabilities > CVE-2004-2547 - Input Validation vulnerability in Netwin Surgemail and Webmail

CVSS 2.6 - LOW

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

NONE

network

high complexity

netwin

exploit available

NVD

Published: 2004-12-31

Updated: 2017-07-11

Summary

NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to obtain sensitive information via HTTP requests that (a) specify the / URI, (b) specify the /scripts/ URI, or (c) specify a non-existent file, which reveal the path in an error message.

Vulnerable Configurations

Part	Description	Count
Application	Netwin Netwin Surgemail 1.0C Netwin Surgemail 1.0D Netwin Surgemail 1.1A Netwin Surgemail 1.1B Netwin Surgemail 1.1C Netwin Surgemail 1.1D Netwin Surgemail 1.2A Netwin Surgemail 1.2B Netwin Surgemail 1.2C Netwin Surgemail 1.3A Netwin Surgemail 1.3A_Rc1 Netwin Surgemail 1.3B Netwin Surgemail 1.3C Netwin Surgemail 1.3D Netwin Surgemail 1.3E Netwin Surgemail 1.3F Netwin Surgemail 1.3G Netwin Surgemail 1.3H Netwin Surgemail 1.3I Netwin Surgemail 1.3J Netwin Surgemail 1.3K Netwin Surgemail 1.3L Netwin Surgemail 1.4A Netwin Surgemail 1.4B Netwin Surgemail 1.4C Netwin Surgemail 1.5A Netwin Surgemail 1.5B Netwin Surgemail 1.5C Netwin Surgemail 1.5D Netwin Surgemail 1.5D2 Netwin Surgemail 1.5F Netwin Surgemail 1.6A Netwin Surgemail 1.6B Netwin Surgemail 1.6D Netwin Surgemail 1.6E Netwin Surgemail 1.6E2 Netwin Surgemail 1.7A Netwin Surgemail 1.7B3 Netwin Surgemail 1.8A Netwin Surgemail 1.8B3 Netwin Surgemail 1.8D Netwin Surgemail 1.8E Netwin Surgemail 1.8G3 Netwin Surgemail 1.9B2 Netwin Surgemail 2.0A2 Netwin Webmail 3.1D	46

Exploit-Db

description	NetWin SurgeMail 1.8/1.9/2.0,WebMail 3.1 Error Message Path Disclosure. CVE-2004-2547. Webapps exploit for php platform
id	EDB-ID:24176
last seen	2016-02-02
modified	2004-06-07
published	2004-06-07
reporter	Donnie Werner
source	https://www.exploit-db.com/download/24176/
title	NetWin SurgeMail 1.8/1.9/2.0,WebMail 3.1 Error Message Path Disclosure

Summary

Vulnerable Configurations

Exploit-Db

References