CVE-2001-0857: Cross-site scripting vulnerability in status.php3 in Imp Webmail 2.2.6 and earlier allows remote attackers...

Security readout for executives and security teams

This old IMP Webmail flaw could let an attacker abuse a webmail page to steal a user's session cookie and read that user's email. It matters only where IMP Webmail 2.2.6 or earlier is still deployed, but exposed legacy webmail should be treated seriously. Likely exposure is low in modern environments because the affected software is very old. Exposure remains plausible on forgotten legacy servers, old Linux distribution packages, or appliances that bundled IMP Webmail and still expose it to users or the internet. Prioritize discovery. If no IMP Webmail exists, no action is needed. If an exposed affected instance exists, treat it as urgent because successful abuse could expose user email and account sessions. Mitigation focus: Identify any IMP Webmail deployments and their exact versions.; Upgrade affected IMP Webmail installations to a vendor-fixed release if still supported.; If upgrade is impossible, retire or isolate the legacy webmail service..

Prepared

Jul 1, 2026, 07:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.