CVE-2003-1481: CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an imag...

Security readout for executives and security teams

Older CommuniGate Pro webmail versions can leak a user’s session ID when loading an image from an email. A malicious email could cause the session token to be sent to an attacker-controlled site, enabling mail session hijacking. The bundle does not provide CVSS, patch details, or active exploitation evidence. Exposure is limited to organizations still running CommuniGate Pro 3.1 through 4.0.6 with vulnerable webmail behavior and remote image loading in email. Modern deployments or later versions are not confirmed affected by the provided bundle. Prioritize if legacy CommuniGate Pro webmail is still in use. The business risk is unauthorized access to mail sessions, which can expose sensitive communications and enable follow-on account abuse. Mitigation focus: Identify any CommuniGate Pro 3.1 through 4.0.6 systems.; Check vendor guidance for fixed versions or supported remediation.; Disable or restrict remote image loading in webmail where possible..

Prepared

Jun 29, 2026, 02:08 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.