CVE-2004-1720
The (1) address.html and possibly (2) calendar.html pages in Merak Mail Server 5.2.7 allow remote...
The (1) address.html and possibly (2) calendar.html pages in Merak Mail Server 5.2.7 allow remote attackers to gain sensitive information via an invalid HTTP request, which reveals the installation path. NOTE: it is unclear whether the calendar.html is an exposure, since the path is leaked in web logs that may only be available to the administrators, who would have access to the path through legitimate means.
Exploit likelihood
What each source reports
NVD Score used
The (1) address.html and possibly (2) calendar.html pages in Merak Mail Server 5.2.7 allow remote attackers to gain sensitive information via an invalid HTTP request, which reveals the installation path. NOTE: it is unclear whether the calendar.html is an exposure, since the path is leaked in web logs that may only be available to the administrators, who would have access to the path through legitimate means.
- Record
CVE-2004-1720- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
The (1) address.html and possibly (2) calendar.html pages in Merak Mail Server 5.2.7 allow remote attackers to gain sensitive information via an invalid HTTP request, which reveals the installation path. NOTE: it is unclear whether the calendar.html is an exposure, since the path is leaked in web logs that may only be available to the administrators, who would have access to the path through legitimate means.
- Record
CVE-2004-1720- Updated
- 2026-11-02
EUVDEUVD-2004-1714 No score
The (1) address.html and possibly (2) calendar.html pages in Merak Mail Server 5.2.7 allow remote attackers to gain sensitive information via an invalid HTTP request, which reveals the installation path. NOTE: it is unclear whether the calendar.html is an exposure, since the path is leaked in web logs that may only be available to the administrators, who would have access to the path through legitimate means.
- Record
EUVD-2004-1714- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3mwg-wvg9-ghpc No score
The (1) address.html and possibly (2) calendar.html pages in Merak Mail Server 5.2.7 allow remote...
The (1) address.html and possibly (2) calendar.html pages in Merak Mail Server 5.2.7 allow remote attackers to gain sensitive information via an invalid HTTP request, which reveals the installation path. NOTE: it is unclear whether the calendar.html is an exposure, since the path is leaked in web logs that may only be available to the administrators, who would have access to the path through legitimate means.
- Record
GHSA-3mwg-wvg9-ghpc- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Merak Mail Server 7.4.5 - address.html Full Path Disclosure | 2004-07-17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-1720 is a medium vulnerability (CVSS 5.0) in Merak Mail Server, published August 17, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.89%, the 94th percentile. No source names a fixed version.
References
packetstormsecurity.nl/0408-exploits/merak527.txt
securityfocus.com/bid/10966
securitytracker.com/id?1010969
marc.info?l=bugtraq&m=109279057326044&w=2
secunia.com/advisories/12269
osvdb.org/9043
exchange.xforce.ibmcloud.com/vulnerabilities/17027
nvd.nist.gov/vuln/detail/CVE-2004-1720
github.com/advisories/GHSA-3mwg-wvg9-ghpc