CVE-2004-2572
AMAX Magic Winmail Server 3.6 allows remote attackers to obtain sensitive information by entering...
AMAX Magic Winmail Server 3.6 allows remote attackers to obtain sensitive information by entering (1) invalid characters such as "()" or (2) a large number of characters in the Lookup field on the netaddressbook.php web form, which reveals the path in an ldaplib.php error message when the ldap_search function fails, due to improper processing of the $keyword variable.
Exploit likelihood
What each source reports
NVD Score used
AMAX Magic Winmail Server 3.6 allows remote attackers to obtain sensitive information by entering (1) invalid characters such as "()" or (2) a large number of characters in the Lookup field on the netaddressbook.php web form, which reveals the path in an ldaplib.php error message when the ldap_search function fails, due to improper processing of the $keyword variable.
- Record
CVE-2004-2572- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
AMAX Magic Winmail Server 3.6 allows remote attackers to obtain sensitive information by entering (1) invalid characters such as "()" or (2) a large number of characters in the Lookup field on the netaddressbook.php web form, which reveals the path in an ldaplib.php error message when the ldap_search function fails, due to improper processing of the $keyword variable.
- Record
CVE-2004-2572- Updated
- 2026-11-02
EUVDEUVD-2004-2563 No score
AMAX Magic Winmail Server 3.6 allows remote attackers to obtain sensitive information by entering (1) invalid characters such as "()" or (2) a large number of characters in the Lookup field on the netaddressbook.php web form, which reveals the path in an ldaplib.php error message when the ldap_search function fails, due to improper processing of the $keyword variable.
- Record
EUVD-2004-2563- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hxrh-xvf9-9m4h No score
AMAX Magic Winmail Server 3.6 allows remote attackers to obtain sensitive information by entering...
AMAX Magic Winmail Server 3.6 allows remote attackers to obtain sensitive information by entering (1) invalid characters such as "()" or (2) a large number of characters in the Lookup field on the netaddressbook.php web form, which reveals the path in an ldaplib.php error message when the ldap_search function fails, due to improper processing of the $keyword variable.
- Record
GHSA-hxrh-xvf9-9m4h- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-2572 is a medium vulnerability (CVSS 5.0) in Amax Information Technologies Magic Winmail Server, published December 31, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.70%, the 77th percentile. No source names a fixed version.
References
exchange.xforce.ibmcloud.com/vulnerabilities/15361
osvdb.org/4118
securityfocus.com/bid/9786
secunia.com/advisories/11015
magicwinmail.net/download/english-help.chm
members.lycos.co.uk/r34ct/main/ldaplib/ldaplib.php%20reveal%20local%20path%20of%20Winmail%203.6%20webmail%20directory.txt
nvd.nist.gov/vuln/detail/CVE-2004-2572
github.com/advisories/GHSA-hxrh-xvf9-9m4h