Summary
The target is running at least one instance of IlohaMail version 0.6 or earlier. Such versions suffer from a potential password disclosure problem when databasae information is not saved in the session table.
***** OVS has determined the vulnerability exists on the target ***** simply by looking at the version number of IlohaMail ***** installed there.
Solution
Upgrade to IlohaMail version 0.7.0 or later.
Severity
Classification
-
CVSS Base Score: 5.0
AV:N/AC:L/Au:N/C:P/I:N/A:N
Related Vulnerabilities
- Adiscon LogAnalyzer 'highlight' Parameter Cross Site Scripting Vulnerability
- Apache Solr Directory Traversal Vulnerability Jan-14
- A4Desk Event Calendar 'eventid' Parameter SQL Injection Vulnerability
- Apache Struts Showcase Multiple Persistence Cross-Site Scripting Vulnerabilities
- Apache Struts CookBook/Examples Multiple Cross-Site Scripting Vulnerabilities