Vulnerabilities > CVE-2011-3579 - Resource Management Errors vulnerability in Icewarp Mail Server

047910
CVSS 6.4 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
icewarp
CWE-399
exploit available
NVD
Published: 2011-09-30
Updated: 2017-08-29

Summary

server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference.

Vulnerable Configurations

Part Description Count
Application
Icewarp
23

Common Weakness Enumeration (CWE)

Exploit-Db

descriptionIceWarp Mail Server 10.3.2 server/webmail.php Soap Message Parsing Remote Arbitrary File Disclosure. CVE-2011-3579. Webapps exploit for php platform
idEDB-ID:36165
last seen2016-02-04
modified2011-09-24
published2011-09-24
reporterDavid Kirkpatrick
sourcehttps://www.exploit-db.com/download/36165/
titleIceWarp Mail Server 10.3.2 server/webmail.php Soap Message Parsing Remote Arbitrary File Disclosure

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/105320/TWSL2011-013.txt
idPACKETSTORM:105320
last seen2016-12-05
published2011-09-23
reportertrustwave.com
sourcehttps://packetstormsecurity.com/files/105320/IceWarp-Mail-Server-Injection-Information-Disclosure.html
titleIceWarp Mail Server Injection / Information Disclosure

References