| Package | Affected versions | Patched versions |
|---|---|---|
| neon webmail | = 5.06= 5.07 |
The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the in_id parameter, which allows remote attackers to modify information of arbitrary users, as demonstrated by modifying (1) passwords and (2) permissions, (3) viewing profile settings, and (4) creating and (5) deleting users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free