Information disclosure in Apache Pony Mail
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derived information disclosure on private lists about the timing of specific email subjects or text bodies, though without disclosing the content itself. As this was primarily used as a caching feature for faster loading times, the caching was disabled by default to prevent this. Users using 0.9 should upgrade to 0.10 to address this issue.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-5658
- 2026-10-03 Alias added: GHSA-hx6p-r9cg-jvwv
References
More Apache Pony Mail vulnerabilities
- TI-2016-03834 Apache Pony Mail 0.6c through 0.8b allows remote attackers to bypass authentication. CVSS 3.0CRITICAL 9.8
- TI-2026-30278 Pony Mail: Admin account takeover via request smuggling CVSS 3.1CRITICAL 9.8
- TI-2019-00191 Cross-site scripting in Apache Pony Mail CVSS 3.0MEDIUM 6.1
Sources
- CVE-2017-5658 · CVE Program
- CVE-2017-5658 · NVD
- FIRST EPSS
- GHSA-hx6p-r9cg-jvwv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences