CVE-2004-1672: attachment.html in Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7 and possibly other versions allows r...

Security readout for executives and security teams

This old CVE describes a privacy failure in Merak Mail Server with Icewarp Web Mail: a remote user could view another user’s email attachments by manipulating request identifiers. The main business risk is unauthorized disclosure of sensitive documents stored in mail. The affected scope and fixed version are not clear in the provided sources. Exposure is most likely where legacy Merak Mail Server or Icewarp Web Mail is still reachable, especially internet-facing webmail. The CVE data lists affected products as incomplete, so teams should verify by software inventory rather than CPE matching alone. Treat this as a targeted confidentiality risk for any remaining legacy Icewarp/Merak webmail. It is not KEV-listed in the provided data, but exposed mail attachments can contain high-value business information, so inventory and retirement decisions should be prompt. Mitigation focus: Inventory Merak Mail Server and Icewarp Web Mail instances, including legacy or archived systems.; Check IceWarp or vendor guidance for fixed versions, upgrades, or retirement recommendations.; Remove or restrict public access to affected legacy webmail until remediation is confirmed..

Prepared

Jun 30, 2026, 00:10 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.