CVE-2006-6701: CSRF
First published: Sat Dec 23 2006(Updated: )
Cross-site request forgery (CSRF) vulnerability in util.pl in @Mail WebMail 4.51, and util.php in 5.x before 5.03, allows remote attackers to modify arbitrary settings and perform unauthorized actions as an arbitrary user, as demonstrated using a settings action in the SRC attribute of an IMG element in an HTML e-mail.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jason Flatt Basic Webmail | =3.0 | |
| Jason Flatt Basic Webmail | =4.51 | |
| Jason Flatt Basic Webmail | =4.0 | |
| =3.0 | ||
| =4.0 | ||
| =4.51 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.netragard.com/html/recent_research.html
- http://secunia.com/advisories/23472
- http://securitytracker.com/id?1017435
- http://www.netragard.com/pdfs/research/ATMAIL-XSRF-ADVISORY-20061206.txt
- http://terra.calacode.com/mail/docs/changelog.html
- http://secunia.com/advisories/25328
- http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0512.html
- http://www.vupen.com/english/advisories/2007/1864
- https://exchange.xforce.ibmcloud.com/vulnerabilities/31259
- http://www.securityfocus.com/archive/1/458109/100/100/threaded
Frequently Asked Questions
What is the severity of CVE-2006-6701?
CVE-2006-6701 is considered a medium severity vulnerability due to its ability to allow unauthorized actions by remote attackers.
How do I fix CVE-2006-6701?
To fix CVE-2006-6701, upgrade to the latest version of Atmail WebMail that addresses the CSRF vulnerability.
What types of software are affected by CVE-2006-6701?
CVE-2006-6701 affects Atmail WebMail versions 3.0, 4.0, and 4.51.
What can an attacker do with CVE-2006-6701?
An attacker exploiting CVE-2006-6701 can modify settings and perform unauthorized actions as any user within the affected application.
Is CVE-2006-6701 easy to exploit?
CVE-2006-6701 can be easily exploited using CSRF attack techniques, such as embedding malicious URLs.
- agent/references
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/severity
- agent/author
- agent/description
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/source
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/tags
- vendor/atmail
- canonical/jason flatt basic webmail
- version/jason flatt basic webmail/3.0
- version/jason flatt basic webmail/4.51
- version/jason flatt basic webmail/4.0