Lucene search

[email protected]CVE-2004-2704

HistoryOct 06, 2007 - 9:00 p.m.

CVE-2004-2704

2007-10-0621:00:00

CWE-79

[email protected]

web.nvd.nist.gov

hastymail

xss

content-disposition

attachment

nvd

cve-2004-2704

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.044 Low

EPSS

Percentile

92.4%

JSON

Hastymail 1.0.1 and earlier (stable) and 1.1 and earlier (development) does not send the “attachment” parameter in the Content-Disposition field for attachments, which causes the attachment to be rendered inline by Internet Explorer when the victim clicks the download link, which facilitates cross-site scripting (XSS) and possibly other attacks.

Affected configurations

NVD

Node

hastymailhastymailRange≤1.0.1

hastymailhastymailRange≤1.1

microsoftinternet_explorer

CPENameOperatorVersion
hastymail:hastymailhastymaille1.0.1
hastymail:hastymailhastymaille1.1
microsoft:internet_explorermicrosoft internet explorereq*

CPE	Name	Operator	Version
hastymail:hastymail	hastymail	le	1.0.1
hastymail:hastymail	hastymail	le	1.1
microsoft:internet_explorer	microsoft internet explorer	eq	*

References

archives.neohapsis.com/archives/bugtraq/2004-08/0322.html

hastymail.sourceforge.net/security.php

secunia.com/advisories/12358

securitytracker.com/id?1011054

www.osvdb.org/9131

www.securityfocus.com/bid/11022

exchange.xforce.ibmcloud.com/vulnerabilities/17091

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.044 Low

EPSS

Percentile

92.4%

JSON

Related for CVE-2004-2704

nessus1 cvelist1 nvd1