NVD

Id
63562  
Name
CVE-2006-4954  
Description
The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the in_id parameter, which allows remote attackers to modify information of arbitrary users, as demonstrated by modifying (1) passwords and (2) permissions, (3) viewing profile settings, and (4) creating and (5) deleting users.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2016-12-20  
Published
2006-09-23  
Modified Date
2016-11-28  
Seq
2006-4954  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
331281 63562 CVE-2006-4954 http://vuln.sg/neonmail506-en.html  View
331282 63562 CVE-2006-4954 20109  View
331283 63562 CVE-2006-4954 84203  View
331284 63562 CVE-2006-4954 neonwebmail-updateuser-security-bypass(29089)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
59886 JVNDB-2006-002152 Neon WebMail の updateuser サーブレットにおける任意のユーザの情報を変更される脆弱性 Java 用の Neon WebMail の updateuser サーブレットは、in_id パラメータを検証しないため、任意のユーザの情報を変更される脆弱性が存在します。 CVE-2006-4954 21056 CVE-2006-4954 63562 7.5 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-002152.html 2006-09-23 2012-09-25 View