CVE-2004-1720: The (1) address.html and possibly (2) calendar.html pages in Merak Mail Server 5.2.7 allow remote attackers...

Security readout for executives and security teams

This is an old information disclosure issue in Merak Mail Server 5.2.7 webmail. A bad HTTP request to address.html, and possibly calendar.html, could reveal the server installation path. That path alone is not system compromise, but it can help attackers map the environment. Exposure appears limited to organizations still running Merak Mail Server 5.2.7 with webmail reachable by remote users. address.html is the clearer affected page. calendar.html should be treated as uncertain based on the CVE note. Treat this as low urgency unless legacy Merak webmail is internet-facing. The main risk is environment reconnaissance, but unsupported or obsolete mail infrastructure may indicate broader operational risk needing cleanup. Mitigation focus: Inventory any remaining Merak Mail Server 5.2.7 webmail deployments.; Check vendor or successor-product guidance for supported upgrade or mitigation options.; Restrict public access to legacy webmail where business use allows..

Prepared

Jun 29, 2026, 23:55 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.