PT-2005-5054 · Roundcube · Roundcube Webmail

Publicado 2005-12-20 · Atualizado 2018-10-19 · CVE-2005-4368

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Roundcube Webmail Alpha

Description The issue allows remote attackers to obtain the full path of the application via an invalid task parameter. This occurs when the default high verbose level is set, specifically with $rcmail config['debug level'] equal to 1. The path is leaked in an error message.

Recommendations For Roundcube Webmail Alpha, consider setting $rcmail config['debug level'] to a lower value to minimize the amount of information disclosed in error messages. As a temporary workaround, restrict access to the application to minimize the risk of path disclosure until a more permanent solution is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2005-4368

Produtos afetados

Roundcube Webmail

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2005-4368 · Nota de Segurança
• http://securityfocus.com/archive/1/422168/100/0/threaded · Nota
• http://securityfocus.com/archive/1/419710/100/0/threaded · Nota
• http://securityfocus.com/archive/1/418851/100/0/threaded · Nota