« Volver al listado

CVE-2002-0490

Estado: ModificadaAlta (10)—

Instant Web Mail before 0.60 does not properly filter CR/LF sequences, which allows remote attackers to (1) execute arbitrary POP commands via the id parameter in message.php, or (2) modify certain mail message headers via numerous parameters in write.php.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Instant WEB Mail — Instant WEB Mail

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2002-0490",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2002-08-12T04:00:00.000",
  "references": [
    {
      "url": "http://instantwebmail.sourceforge.net/#changeLog",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.iss.net/security_center/static/8650.php",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/264041",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/4361",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://instantwebmail.sourceforge.net/#changeLog",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.iss.net/security_center/static/8650.php",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/264041",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/4361",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Instant Web Mail before 0.60 does not properly filter CR/LF sequences, which allows remote attackers to (1) execute arbitrary POP commands via the id parameter in message.php, or (2) modify certain mail message headers via numerous parameters in write.php."
    }
  ],
  "lastModified": "2026-06-16T21:57:32.747",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:instant_web_mail:instant_web_mail:0.55:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F61E0C8E-7C59-4D06-BBDF-254891F3F517"
            },
            {
              "criteria": "cpe:2.3:a:instant_web_mail:instant_web_mail:0.56:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1CEFD56D-959B-4BB6-8376-CE3062F1CCFF"
            },
            {
              "criteria": "cpe:2.3:a:instant_web_mail:instant_web_mail:0.57:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7C10550-FD9A-4467-B904-33CF68B2419C"
            },
            {
              "criteria": "cpe:2.3:a:instant_web_mail:instant_web_mail:0.58:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C550C08-5DC2-4386-B4F2-8B7B31887538"
            },
            {
              "criteria": "cpe:2.3:a:instant_web_mail:instant_web_mail:0.59:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64AE4E6A-8881-4949-93A2-03894FBD0679"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}