{"api_version":"1","generated_at":"2026-07-23T10:04:18+00:00","cve":"CVE-2006-4954","urls":{"html":"https://cve.report/CVE-2006-4954","api":"https://cve.report/api/cve/CVE-2006-4954.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-4954","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-4954"},"summary":{"title":"CVE-2006-4954","description":"The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the in_id parameter, which allows remote attackers to modify information of arbitrary users, as demonstrated by modifying (1) passwords and (2) permissions, (3) viewing profile settings, and (4) creating and (5) deleting users.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2006-09-23 10:07:00","updated_at":"2017-07-20 01:33:00"},"problem_types":["NVD-CWE-Other"],"metrics":[],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/29089","name":"neonwebmail-updateuser-security-bypass(29089)","refsource":"XF","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/20109","name":"20109","refsource":"BID","tags":["Exploit","Patch"],"title":"Neon WebMail For Java Multiple Input Validation Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securityfocus.com/bid/84203","name":"84203","refsource":"BID","tags":[],"title":"Neon Webmail CVE-2006-4954 Remote Security Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/22029","name":"22029","refsource":"SECUNIA","tags":["Patch","Vendor Advisory"],"title":"Neon WebMail for Java Multiple Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://vuln.sg/neonmail506-en.html","name":"http://vuln.sg/neonmail506-en.html","refsource":"MISC","tags":["Exploit","Patch"],"title":"[vuln.sg] Neon WebMail for Java Multiple Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-4954","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-4954","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"4954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"neosys","cpe5":"neon_webmail","cpe6":"5.06","cpe7":"*","cpe8":"java","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4954","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"neosys","cpe5":"neon_webmail","cpe6":"5.07","cpe7":"*","cpe8":"java","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4954","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"neosys","cpe5":"neon_webmail","cpe6":"5.06","cpe7":"*","cpe8":"java","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4954","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"neosys","cpe5":"neon_webmail","cpe6":"5.07","cpe7":"*","cpe8":"java","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-4954","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the in_id parameter, which allows remote attackers to modify information of arbitrary users, as demonstrated by modifying (1) passwords and (2) permissions, (3) viewing profile settings, and (4) creating and (5) deleting users."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20109","refsource":"BID","url":"http://www.securityfocus.com/bid/20109"},{"name":"http://vuln.sg/neonmail506-en.html","refsource":"MISC","url":"http://vuln.sg/neonmail506-en.html"},{"name":"22029","refsource":"SECUNIA","url":"http://secunia.com/advisories/22029"},{"name":"neonwebmail-updateuser-security-bypass(29089)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/29089"},{"name":"84203","refsource":"BID","url":"http://www.securityfocus.com/bid/84203"}]}},"nvd":{"publishedDate":"2006-09-23 10:07:00","lastModifiedDate":"2017-07-20 01:33:00","problem_types":["NVD-CWE-Other"],"metrics":{"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:neosys:neon_webmail:5.06:*:java:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:neosys:neon_webmail:5.07:*:java:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"4954","Ordinal":"20296","Title":"CVE-2006-4954","CVE":"CVE-2006-4954","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"4954","Ordinal":"1","NoteData":"The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the in_id parameter, which allows remote attackers to modify information of arbitrary users, as demonstrated by modifying (1) passwords and (2) permissions, (3) viewing profile settings, and (4) creating and (5) deleting users.","Type":"Description","Title":null},{"CveYear":"2006","CveId":"4954","Ordinal":"2","NoteData":"2006-09-23","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"4954","Ordinal":"3","NoteData":"2017-07-19","Type":"Other","Title":"Modified"}]}}}