CVEvulnerability

CVE-2002-0490

10.0 HIGH Published 2002-08-12 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2002-08-12
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 2.0 ([email protected]): 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C

Description

Instant Web Mail before 0.60 does not properly filter CR/LF sequences, which allows remote attackers to (1) execute arbitrary POP commands via the id parameter in message.php, or (2) modify certain mail message headers via numerous parameters in write.php.

Affected configurations

• instant web mail instant web mail 0.55 • instant web mail instant web mail 0.56 • instant web mail instant web mail 0.57 • instant web mail instant web mail 0.58 • instant web mail instant web mail 0.59

References

http://instantwebmail.sourceforge.net/#changeLog instantwebmail.sourceforge.net
http://www.iss.net/security_center/static/8650.php Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/264041 Vendor Advisory
http://www.securityfocus.com/bid/4361 Patch, Vendor Advisory
http://instantwebmail.sourceforge.net/#changeLog instantwebmail.sourceforge.net
http://www.iss.net/security_center/static/8650.php Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/264041 Vendor Advisory
http://www.securityfocus.com/bid/4361 Patch, Vendor Advisory