Vulnerability in Rockliffe Mailsite Express
CVE-2005-3430
Incomplete blacklist vulnerability in Rockliffe MailSite Express before 6.1.22 allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions, such as (1) .unk, (2) .asa, and possibly (3) .htr and (4) .aspx, which are not filtered like the .asp extension.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.018 (77.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 77.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.018 · newest: 0.018 · change: 0.000
Affected products
- Rockliffe Mailsite Express — versions 6.1.20
References
- archives.neohapsis.com/archives/fulldisclosure/2005-10/0578.html (mailing-list, Patch)
- exchange.xforce.ibmcloud.com/vulnerabilities/22907 (vdb-entry)
- securitytracker.com/id (vdb-entry)
- www.security-assessment.com/Advisories/Rockliffe_Express_Webmail_Vulnerabilitie… (Patch, Vendor Advisory)
- secunia.com/advisories/17240/ (Vendor Advisory, third-party-advisory)
- www.securityfocus.com/bid/15230 (vdb-entry)
- marc.info/ (mailing-list)