CVE-2003-1481

CVE-2003-1481 describes a session hijacking vulnerability in CommuniGate Pro versions 3.1 through 4.0.6. The flaw allows remote attackers to steal mail session IDs by exploiting the software's practice of sending the session ID in the HTTP referer field when requesting an image. An attacker could craft a malicious email containing an IMG tag pointing to a controlled URL, thereby capturing the victim's session ID. This vulnerability has a CVSS score of 5.8, indicating a medium severity. It requires medium attack complexity (AC:M) as it relies on a user clicking a malicious link, but does not require authentication (Au:N). The primary impact is a loss of confidentiality and integrity (C:P/I:P) due to unauthorized access to mail sessions. While not listed in CISA's KEV catalog, exploit code for this vulnerability is publicly available on ExploitDB (EDB-27). There is no evidence of active exploitation, and the CVE has received minimal community discussion or media coverage.