JVNDB-2007-000229

MailDwarf vulnerability allows unauthorized sending of emails

MailDwarf, released from HTML Dwarf, is a CGI program that enables a user to send e-mail message via web page. MailDwarf contains a vulnerability that allows unauthorized email to be sent to a different address set by the administrator.

Base Metrics: 5.0 (Medium) [IPA Score]

• Access Vector: Network
• Access Complexity: Low
• Authentication: None
• Confidentiality Impact: None
• Integrity Impact: Partial
• Availability Impact: None

HTML Dwarf

• MailDwarf ver3.01 or earlier

A remote attacker may exploit the vulnerability to send unsolicited mails to arbitrary email addresses.

HTML Dwarf

• htmldwarf.hanameiro.net : MailDwarf ver3.10

1. JVN : JVN#08951968
2. National Vulnerability Database (NVD) : CVE-2007-1803
3. Common Vulnerabilities and Exposures (CVE) : CVE-2007-1803
4. Secunia Advisory : SA24681
5. SecurityFocus : 23207
6. ISS X-Force Database : 33324
7. FrSIRT Advisories : FrSIRT/ADV-2007-1166
8. Common Weakness Enumeration (CWE) : Insufficient Input Validation (CWE-20) [NVD Evaluation]

[2008/05/21]
  Web page published