CVE-2017-5658 Information disclosure in Apache Pony Mail
An attacker can access timestamp metadata from private mailing lists without authorization, potentially revealing communication patterns.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-5658?
CVE-2017-5658 is a medium-severity vulnerability in Apache Pony Mail, published on 4 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derived information disclosure on private lists about the timing of specific email subjects or text bodies, though without disclosing the content itself. As this was primarily used as a caching feature for faster loading times, the caching was disabled by default to prevent this. Users using 0.9 should upgrade to 0.10 to address this issue.
Weakness: CWE-200
Which versions are affected by CVE-2017-5658?
It affects 1 product.
Products include Apache Pony Mail.
How do I fix CVE-2017-5658?
No fix has been published for CVE-2017-5658 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-5658 being exploited?
There is no known exploitation of CVE-2017-5658 in the wild and no public exploit code.
Other vulnerabilities in Apache Pony Mail
Sources
Also known as GHSA-hx6p-r9cg-jvwv.