CVE-2005-1682 json
JavaMail API, as used by Solstice Internet Mail Server POP3 2.0, does not properly validate the message number in the MimeMessage construct…
published 2005-05-20 21 y ago modified 2026-06-16 4 mo ago also EUVD-2005-1684
- cvss
- 2.1
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
JavaMail API, as used by Solstice Internet Mail Server POP3 2.0, does not properly validate the message number in the MimeMessage constructor in javax.mail.internet.InternetHeaders, which allows remote authenticated users to read other users' e-mail messages by modifying the msgno parameter. NOTE: Sun disputes this issue, stating "The report makes references to source code and files that do not exist in the mentioned products.
Exploit prediction
0.69% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
vupen.com
/english/advisories/2005/0574
vdb-entry, vendor-advisory
-
marc.info
/?l=bugtraq&m=111653029605189&w=2
mailing-list
Sources
- CVE List CVE-2005-1682
- NVD CVE-2005-1682
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.