The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the in_id parameter, which allows remote attackers to modify information of arbitrary users, as demonstrated by modifying (1) passwords and (2) permissions, (3) viewing profile settings, and (4) creating and (5) deleting users.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2006-09-23T10:00:00
Updated: 2024-08-07T19:32:22.338Z
Reserved: 2006-09-22T00:00:00
Link: CVE-2006-4954
Vulnrichment
No data.
NVD
Status : Modified
Published: 2006-09-23T10:07:00.000
Modified: 2017-07-20T01:33:24.913
Link: CVE-2006-4954
Redhat
No data.