JVNDB-2013-000031

Active! mail vulnerable to information disclosure

Active! mail contains an information disclosure vulnerability.

Active! mail provided by TransWARE is a webmail software. Active! mail contains an information disclosure vulnerability.

Mitsuru Ogino of Sugiyama Jogakuen reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

TransWARE Co.

• Active! mail 6

If the "external public interface" is enabled, an attacker who can log into the server may obtain users credentials.

[Restrict log-in to the server]
Allow connections only from an administrator or trusted users.

[Do not use the "external public interface" function]
Turn off the "external public interface" if the function is not necessary.

For more information, refer to the information provided by the developer.

TransWARE Co.

• JVN : Information from TransWARE Co.

1. Information Exposure(CWE-200) [IPA Evaluation]

1. CVE-2013-2302

1. JVN : JVN#04288738
2. National Vulnerability Database (NVD) : CVE-2013-2302

• [2013/04/04]
    Web page was published
  [2013/06/25]
    References : Content was added