CVE-2005-4558

CVE-2005-4558 is a medium-severity vulnerability in Deerfield Visnetic Mail Server with a CVSS 2.0 base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Description

IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly restrict acceptable values for the language parameter to mail/settings.html before it is stored in a database, which can allow remote authenticated users to include arbitrary PHP code via a URL in a modified lang_settings parameter to mail/index.html.

Frequently asked questions

What is CVE-2005-4558?
IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly restrict acceptable values for the language parameter to mail/settings.html before it is stored in a database, which can allow remote authenticated users to include arbitrary PHP code via a URL in a modified lang_settings parameter to mail/index.html.
How severe is CVE-2005-4558?
CVE-2005-4558 has a CVSS 2.0 base score of 6.5, rated medium severity.
Is CVE-2005-4558 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 8% (94th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2005-4558?
CVE-2005-4558 primarily affects Deerfield Visnetic Mail Server. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2005-4558?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2005-4558 published?
CVE-2005-4558 was published on 2005-12-28 and last updated on 2026-06-16.

References

Affected products (3)

More vulnerabilities in Deerfield Visnetic Mail Server

All CVEs affecting Deerfield Visnetic Mail Server →