CVE-2004-1023
Last modified
CVE-2004-1023 is a vulnerability of currently unknown severity. Kerio Winroute Firewall before 6.0.9, ServerFirewall before 1.0.1, and MailServer before 6.0.5, when installed on Windows based systems, do not modify the ACLs for critical files, which allows local users with Power Users privileges to modify programs, install malicious DLLs in the plug-ins folder, and modify XML files related to configuration.. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
Kerio Winroute Firewall before 6.0.9, ServerFirewall before 1.0.1, and MailServer before 6.0.5, when installed on Windows based systems, do not modify the ACLs for critical files, which allows local users with Power Users privileges to modify programs, install malicious DLLs in the plug-ins folder, and modify XML files related to configuration.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Kerio | Kerio Mailserver | 6.0.0 |
| Kerio | Kerio Mailserver | 6.0.1 |
| Kerio | Kerio Mailserver | 6.0.2 |
| Kerio | Kerio Mailserver | 6.0.3 |
| Kerio | Kerio Mailserver | 6.0.4 |
| Kerio | Serverfirewall | 1.0.0 |
| Kerio | Winroute Firewall | 6.0.0 |
| Kerio | Winroute Firewall | 6.0.1 |
| Kerio | Winroute Firewall | 6.0.2 |
| Kerio | Winroute Firewall | 6.0.3 |
| Kerio | Winroute Firewall | 6.0.4 |
| Kerio | Winroute Firewall | 6.0.5 |
| Kerio | Winroute Firewall | 6.0.6 |
| Kerio | Winroute Firewall | 6.0.7 |
| Kerio | Winroute Firewall | 6.0.8 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2004-1023?
How severe is CVE-2004-1023?
How do I fix CVE-2004-1023?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2004
- CVE-2004-1017Multiple "overflows" in the io_edgeport driver for Linux ker…
- CVE-2004-1018Multiple integer handling errors in PHP before 4.3.10 allow …
- CVE-2004-1019The deserialization code in PHP before 4.3.10 and PHP 5.x up…
- CVE-2004-1020The addslashes function in PHP 4.3.9 does not properly escap…
- CVE-2004-1021iCal before 1.5.4 on Mac OS X 10.2.3, and other later versio…
- CVE-2004-1022Kerio Winroute Firewall before 6.0.7, ServerFirewall before …
- CVE-2004-1025Multiple heap-based buffer overflows in imlib 1.9.14 and ear…
- CVE-2004-1026Multiple integer overflows in the image handler for imlib 1.…
- CVE-2004-1027Directory traversal vulnerability in the -x (extract) comman…
- CVE-2004-1028Untrusted execution path vulnerability in chcod on AIX IBM 5…
- CVE-2004-1029The Sun Java Plugin capability in Java 2 Runtime Environment…
- CVE-2004-1030fcronsighup in Fcron 2.0.1, 2.9.4, and possibly earlier vers…
Are you affected by CVE-2004-1023?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST