VulnerabilityModified
CVE-2000-0716
WorldClient email client in MDaemon 2.8 includes the session ID in the referer field of an HTTP request when the user clicks on a URL, which allows the visited web site to hijack the session ID and read the user's email.
LOW 2.6EPSS 1.10%
Does this matter?
Lower severity and a low EPSS score (1.10%). Track it; it rarely justifies an emergency change on its own.
Description
WorldClient email client in MDaemon 2.8 includes the session ID in the referer field of an HTTP request when the user clicks on a URL, which allows the visited web site to hijack the session ID and read the user's email.
- CVSS 2.0
- 2.6 LOWAV:N/AC:H/Au:N/C:P/I:N/A:N
- EPSS
- 1.10% probability · 64th percentile
- CISA KEV
- Not listed
- Affected
- alt-n/mdaemon
- Source
- cve@mitre.org
References
- http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0008&L=ntbugtraq&F=&S=&P=459Patch, Vendor Advisory
- http://www.securityfocus.com/bid/1553Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/5070
- http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0008&L=ntbugtraq&F=&S=&P=459Patch, Vendor Advisory
- http://www.securityfocus.com/bid/1553Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/5070
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.