1. CVE-Search
  2. CVE-2005-3430
ID CVE-2005-3430
Summary Incomplete blacklist vulnerability in Rockliffe MailSite Express before 6.1.22 allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions, such as (1) .unk, (2) .asa, and possibly (3) .htr and (4) .aspx, which are not filtered like the .asp extension.
References
Vulnerable Configurations
  • cpe:2.3:a:rockliffe:mailsite_express:6.1.20:*:*:*:*:*:*:*
    cpe:2.3:a:rockliffe:mailsite_express:6.1.20:*:*:*:*:*:*:*
  • cpe:2.3:a:rockliffe:mailsite_express:*:*:*:*:*:*:*:*
    cpe:2.3:a:rockliffe:mailsite_express:*:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 11-07-2017 - 01:33)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 15230
bugtraq 20051028 Multiple vulnerabilities within RockLiffe MailSite Express WebMail
fulldisc 20051028 Multiple vulnerabilities within RockLiffe MailSite Express WebMail
misc http://www.security-assessment.com/Advisories/Rockliffe_Express_Webmail_Vulnerabilities.pdf
sectrack 1015117
secunia 17240
xf mailsiteexpress-attachment-script-execution(22907)
Last major update 11-07-2017 - 01:33
Published 02-11-2005 - 11:02
Last modified 11-07-2017 - 01:33
Back to Top