18 lines
No EOL
942 B
Text
18 lines
No EOL
942 B
Text
Advisory Name:Web Administration Broken Access Control in McAfee Email Gateway (formerly IronMail)
|
||
Vulnerability Class: Broken Access Control
|
||
Release Date: May 19, 2010
|
||
Affected Applications: Secure Mail (Ironmail) ver.6.7.1
|
||
Affected Platforms: FreeBSD 6.2 / Apache-Coyote 1.1
|
||
Local / Remote: Local
|
||
Severity: Medium – CVSS: 6.8 (AV:L/AC:L/Au:S/C:C/I:C/A:C)
|
||
Researcher: Nahuel Grisolía from Cybsec Labs
|
||
Vendor Status: Vendor was informed. A patch is being developed.
|
||
Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerability_policy.pdf
|
||
Vulnerability Description:
|
||
Ironmail was found to allow Web Access users to execute arbitrary actions with Write rights, due to an
|
||
improper profile check.
|
||
|
||
===========
|
||
Download:
|
||
===========
|
||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/12658.pdf (cybsec_advisory_2010_0501_Ironmail_Advisory_Web_Access_Broken_Access.pdf) |