CVE-2009-4354: Transware Active! Mail

Medium severity, CVSS 5.8. EPSS: 1.1% chance of exploitation in the next 30 days.

TransWARE Active! mail 2003 build 2003.0139.0871 and earlier does not properly secure the session ID in a session cookie, which allows remote attackers to hijack web sessions, probably related to the "secure" flag for cookies in SSL sessions.

Affected products

• Transware Active! Mail: up to and including 2003; version 1.422 only; version 2.0 only

Published 2009-12-17. Last modified 2026-06-16.