| Package | Affected versions | Patched versions |
|---|---|---|
| mdaemon | = 2.8 |
WorldClient email client in MDaemon 2.8 includes the session ID in the referer field of an HTTP request when the user clicks on a URL, which allows the visited web site to hijack the session ID and read the user's email.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free