Vulnerability Description
The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derived information disclosure on private lists about the timing of specific email subjects or text bodies, though without disclosing the content itself. As this was primarily used as a caching feature for faster loading times, the caching was disabled by default to prevent this. Users using 0.9 should upgrade to 0.10 to address this issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Pony Mail | >= 0.7, <= 0.9 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread.html/6a18cf5690d54231836f277f2b4346b53da3b6b6b08
- https://lists.apache.org/thread.html/6a18cf5690d54231836f277f2b4346b53da3b6b6b08
FAQ
What is CVE-2017-5658?
CVE-2017-5658 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derived information disclosure on private lists...
How severe is CVE-2017-5658?
CVE-2017-5658 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-5658?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Pony Mail.