Macallan Mail Solution 2.8.4.6 (Build 260), and possibly earlier versions, allows remote attackers to bypass authentication in the web interface via an HTTP GET request with two slashes (//) after the server name.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mail_solution | Macallan | 2.8.4.6_build_260 (including) | 2.8.4.6_build_260 (including) |
References
- http://secunia.com/advisories/10861
- http://securitytracker.com/id?1009030
- http://www.osvdb.org/3926
- http://www.securityfocus.com/bid/9646
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15194
- https://testzone.secunia.com/advisories/10861
- http://secunia.com/advisories/10861
- http://securitytracker.com/id?1009030
- http://www.osvdb.org/3926
- http://www.securityfocus.com/bid/9646
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15194
- https://testzone.secunia.com/advisories/10861