CVE-2006-4954 | BDVDB-2026-19371 Detail

Description#

The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the in_id parameter, which allows remote attackers to modify information of arbitrary users, as demonstrated by modifying (1) passwords and (2) permissions, (3) viewing profile settings, and (4) creating and (5) deleting users.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.securityfocus.com/bid/20109
http://vuln.sg/neonmail506-en.html
http://secunia.com/advisories/22029
https://exchange.xforce.ibmcloud.com/vulnerabilities/29089
http://www.securityfocus.com/bid/84203

Exploit#

No public exploit known

History#

Version 12006-09-23Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.