CVE-2004-2547: Low severity Netwin Surgemail vulnerability
Published Dec 31, 2004
·Updated
NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to obtain sensitive information via HTTP requests that (a) specify the / URI, (b) specify the /scripts/ URI, or (c) specify a non-existent file, which reveal the path in an error message.
Affected Software
46 affected components
Netwin Surgemail=1.3d
Netwin Surgemail=1.1a
Netwin Surgemail=1.8e
Netwin Surgemail=1.6e2
Netwin Surgemail=1.3i
Netwin Surgemail=1.3c
Netwin Surgemail=1.3b
Netwin Surgemail=1.1d
Netwin Surgemail=1.3l
Netwin Surgemail=1.7b3
Netwin Surgemail=1.5f
Netwin Surgemail=1.6e
Netwin Surgemail=1.6d
Netwin Surgemail=1.4c
Netwin Surgemail=1.3k
Netwin Surgemail=1.3a_rc1
Netwin Surgemail=1.5d2
Netwin Surgemail=1.2a
Netwin Surgemail=1.6a
Netwin WebMail=3.1d
Netwin Surgemail=1.5a
Netwin Surgemail=1.3g
Netwin Surgemail=1.5c
Netwin Surgemail=1.0d
Netwin Surgemail=1.3f
Netwin Surgemail=1.3h
Netwin Surgemail=1.1c
Netwin Surgemail=1.2b
Netwin Surgemail=1.5b
Netwin Surgemail=1.4b
Netwin Surgemail=1.1b
Netwin Surgemail=1.0c
Netwin Surgemail=1.8d
Netwin Surgemail=1.8b3
Netwin Surgemail=1.7a
Netwin Surgemail=1.3a
Netwin Surgemail=1.4a
Netwin Surgemail=1.8g3
Netwin Surgemail=1.8a
Netwin Surgemail=2.0a2
Netwin Surgemail=1.3j
Netwin Surgemail=1.6b
Netwin Surgemail=1.3e
Netwin Surgemail=1.9b2
Netwin Surgemail=1.5d
Netwin Surgemail=1.2c
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Dec 31, 2004
CVE Published
05:00 AM
Nov 21, 2005
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-2547?
CVE-2004-2547 is classified as a medium severity vulnerability.
2
How does CVE-2004-2547 affect affected software versions?
CVE-2004-2547 allows attackers to obtain sensitive information from various versions of NetWin SurgeMail and WebMail.
3
How do I fix CVE-2004-2547?
To fix CVE-2004-2547, upgrade to NetWin SurgeMail version 2.0c or later.
4
What types of sensitive information can be exposed by CVE-2004-2547?
CVE-2004-2547 can expose directory paths in error messages.
5
Which products are impacted by CVE-2004-2547?
CVE-2004-2547 impacts multiple versions of NetWin SurgeMail and WebMail.