CVE-2011-3579

server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference.

Affected Software

Name	Vendor	Start Version	End Version
Mail_server	Icewarp	*	10.3.2 (including)
Mail_server	Icewarp	9.3.0 (including)	9.3.0 (including)
Mail_server	Icewarp	9.3.1 (including)	9.3.1 (including)
Mail_server	Icewarp	9.3.2 (including)	9.3.2 (including)
Mail_server	Icewarp	9.4.0 (including)	9.4.0 (including)
Mail_server	Icewarp	9.4.1 (including)	9.4.1 (including)
Mail_server	Icewarp	9.4.2 (including)	9.4.2 (including)
Mail_server	Icewarp	10.0.3 (including)	10.0.3 (including)
Mail_server	Icewarp	10.0.4 (including)	10.0.4 (including)
Mail_server	Icewarp	10.0.7 (including)	10.0.7 (including)
Mail_server	Icewarp	10.0.8 (including)	10.0.8 (including)
Mail_server	Icewarp	10.1.1 (including)	10.1.1 (including)
Mail_server	Icewarp	10.1.2 (including)	10.1.2 (including)
Mail_server	Icewarp	10.1.3 (including)	10.1.3 (including)
Mail_server	Icewarp	10.1.4 (including)	10.1.4 (including)
Mail_server	Icewarp	10.2.0 (including)	10.2.0 (including)
Mail_server	Icewarp	10.2.1 (including)	10.2.1 (including)
Mail_server	Icewarp	10.2.2 (including)	10.2.2 (including)
Mail_server	Icewarp	10.3.0 (including)	10.3.0 (including)
Mail_server	Icewarp	10.3.1 (including)	10.3.1 (including)

NVD	https://nvd.nist.gov/vuln/detail/CVE-2011-3579
CWE	https://cwe.mitre.org/data/definitions/399.html

Affected Software

References