<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1555" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV>Hi,<BR><BR>That last record in my previous email got a little too
much pasted in, for the versions affected. Should be:<BR><BR> CVE-2007-3424
- "tocat" in move Instant Messages parameter - Must be from<BR>referenced thread
note "Instant messages move "to" folder set hard coded<BR>value instead of using
query string value." Not good to use user input for<BR>destination folder name,
albeit there is a filter on traversal. Was not<BR>necessary to use this field
since there is only one folder to which messages<BR>can be moved at this time.
Affected: web-app.org WebAPP v0.9.9.3, 0.9.9.3.1,<BR>0.9.9.3.2, 0.9.9.3.5,
0.9.9.4, and 0.9.9.5, and 0.9.9.6; web-app.net WebAPP<BR>NE v0.9.9.3.3,
0.9.9.3.4; web-app.net WebAPP NE 2007 through at least<BR>20070624. Addressed by
web-app.org WebAPP v0.9.9.7.<BR><BR>There was no Instant Message Move feature
prior to WebAPP v0.9.9.3.<BR><BR>Sorry about that.<BR><BR>Jos Brown<BR>WebAPP
(c) web-app.org<BR></DIV></BODY></HTML>