CVE-2017-5658

published 2018-10-04

CVE-2017-5658: The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to…

Priority P4 27 medium 5.3 CVSS 3.0

AV N AC L PR N UI N S U C L I N A N

The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derived information disclosure on private lists about the timing of specific email subjects or text bodies, though without disclosing the content itself. As this was primarily used as a caching feature for faster loading times, the caching was disabled by default to prevent this. Users using 0.9 should upgrade to 0.10 to address this issue.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	pony_mail	0.7 – 0.9	—
apache_software_foundation	apache_pony_mail	—	—

CVSS provenance

nvd v3.0 5.3 MEDIUM CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200