Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Merak Mail Server/Icewarp Web Mail lets attackers create/rename files

CVE-2004-1670 · published 22 years ago
Summary

The Merak mail server when used with Icewarp Web Mail lets a remote user create new folders or rename existing files by sending specially crafted web requests. This could let an attacker place malicious content on your system or tamper with legitimate data. Update to the latest versions or apply the vendor’s patches to stop the unsafe requests.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
icewarp web_mail 3.3.2
5.2.7
5.2.8
cpe:2.3:a:icewarp:web_mail:3.3.2:*:*:*:*:*:*:*
merak mail_server 7.4.5
cpe:2.3:a:merak:mail_server:7.4.5:*:*:*:*:*:*:*
Original advisory text
Multiple directory traversal vulnerabilities Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7, and possibly other versions, allow remote attackers to (1) create arbitrary directories via a .. (d...
Multiple directory traversal vulnerabilities Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7, and possibly other versions, allow remote attackers to (1) create arbitrary directories via a .. (dot dot) in the user parameter to viewaction.html or (2) rename arbitrary files via a ....// (doubled dot dot) in the folderold or folder parameters to folders.html.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Timeline
Published10 Sep 2004
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2004-1670 · NVD
Track software like this
Free during beta