CVE-2004-2547: NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to obtain sensitive information via...

Security readout for executives and security teams

This is an old information-disclosure issue in NetWin SurgeMail before 2.0c and WebMail. Certain HTTP error responses can reveal server filesystem paths. That does not by itself grant access, but it can help attackers map a target and support follow-on attacks against exposed legacy mail systems. Exposure is most likely where legacy NetWin SurgeMail or WebMail interfaces remain internet-facing, especially versions before SurgeMail 2.0c. The bundle does not provide CPEs or a complete affected-version matrix. Treat this as a legacy exposure cleanup item, not an emergency based on the supplied evidence. Prioritize it if the affected mail interface is internet-facing or part of a broader outdated mail platform. Mitigation focus: Identify any deployed NetWin SurgeMail or WebMail systems.; Check vendor update guidance, especially SurgeMail 2.0c or later references.; Restrict internet exposure for legacy mail administration and webmail interfaces..

Prepared

Jun 29, 2026, 16:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.