5.8med
CVE-2003-14811 exploit
CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers…
Published 22 y ago · modified 4 mo ago · JSON
CVSS
5.8
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.8%
percentile 79%
Public exploits
1
Exploit-DB
Summary
CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers to hijack mail sessions via an e-mail with an IMG tag that references a malicious URL that captures the referer.
Exploit prediction (EPSS)
1.84% probability of exploitation in the next 30 days, higher than 79% of all scored CVEs.
Exploits and detections
- EDB-27 CommuniGate Pro Webmail 4.0.6 - Session Hijacking · remote · 2003-05-05
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
Classification
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
- securityfocus.com /archive/1/320438 · mailing-list, x_refsource_BUGTRAQ, x_transferred
- securityreason.com /securityalert/3290 · third-party-advisory, x_refsource_SREASON, x_transferred
- securityfocus.com /bid/7501 · vdb-entry, x_refsource_BID, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/11932 · vdb-entry, x_refsource_XF, x_transferred
Sources
- CVE List: CVE-2003-1481
- NVD: CVE-2003-1481
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.