PT-2005-1410 · Desknow · Desknow Mail/Collaboration Server

Tan Chew Keong · Publicado 2005-02-10 · Atualizado 2017-07-11 · CVE-2005-0332

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DeskNow Mail and Collaboration Server version 2.5.12

Description A directory traversal issue allows remote attackers to upload and possibly execute files outside the intended directory by manipulating the AttachmentsKey parameter to the "attachment.do" endpoint, or delete arbitrary files via the select file parameter to the "file.do" endpoint.

Recommendations For DeskNow Mail and Collaboration Server version 2.5.12, consider restricting access to the "attachment.do" and "file.do" endpoints until a fix is available, and avoid using the AttachmentsKey and select file parameters in these endpoints to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-0332

Produtos afetados

Desknow Mail/Collaboration Server

Referências · 9

• https://exchange.xforce.ibmcloud.com/vulnerabilities/19206 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19211 · Nota
• http://securityfocus.com/bid/12421 · Correção
• http://security.org.sg/vuln/desknow2512.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-0332 · Nota de Segurança
• http://secunia.com/advisories/14116 · Nota
• http://marc.info/?l=bugtraq&m=110737616324614&w=2 · Nota
• http://securitytracker.com/id?1013060 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19212 · Nota