PT-2001-2190 · Basilix · Basilix Webmail

Publicado 2001-01-11 · Atualizado 2017-12-19 · CVE-2001-1044

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Basilix Webmail version 0.9.7beta

Description The issue allows remote attackers to obtain sensitive information, such as MySQL passwords and usernames, from the mysql.class file because the software stores *.class and *.inc files under the document root without restricting access.

Recommendations For version 0.9.7beta, restrict access to the *.class and *.inc files, especially the mysql.class file, to prevent remote attackers from obtaining sensitive information. Consider moving these files outside of the document root or implementing proper access controls.

Exploit

Correção

Identificadores relacionados

CVE-2001-1044

Produtos afetados

Basilix Webmail

Referências · 5

• 🔥 http://securityfocus.com/archive/1/155897 · Exploit
• 🔥 https://exploit-db.com/exploits/20538 · Exploit
• 🔥 http://securityfocus.com/bid/2198 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-1044 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5934 · Nota