[Japanese]

JVNDB-2007-000229

MailDwarf vulnerability allows unauthorized sending of emails

Overview

MailDwarf, released from HTML Dwarf, is a CGI program that enables a user to send e-mail message via web page. MailDwarf contains a vulnerability that allows unauthorized email to be sent to a different address set by the administrator.
CVSS Severity (What is CVSS?)

CVSS V2 Severity:
Base Metrics 5.0 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Low
  • Authentication: None
  • Confidentiality Impact: None
  • Integrity Impact: Partial
  • Availability Impact: None
Affected Products


HTML Dwarf
  • MailDwarf ver3.01 or earlier

Impact

A remote attacker may exploit the vulnerability to send unsolicited mails to arbitrary email addresses.
Solution

Vendor Information

HTML Dwarf
CWE (What is CWE?)

  1. Improper Input Validation(CWE-20) [NVD Evaluation]
CVE (What is CVE?)

  1. CVE-2007-1803
References

  1. JVN : JVN#08951968
  2. National Vulnerability Database (NVD) : CVE-2007-1803
  3. Secunia Advisory : SA24681
  4. SecurityFocus : 23207
  5. ISS X-Force Database : 33324
  6. FrSIRT Advisories : FrSIRT/ADV-2007-1166
Revision History

  • [2008/05/21]
      Web page published

Date Public2007/03/30
Date First Published2008/05/21
Date Last Updated2008/05/21