PT-2007-1341 · Kamgaing · Kamgaing Email System

Publicado 2007-02-24 · Atualizado 2017-07-29 · CVE-2006-7062

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kamgaing Email System (kmail) versions 2.3 and earlier

Description The issue allows remote attackers to obtain the full path of the server via an invalid d parameter in the calendar.php file, which leaks the path in an error message.

Recommendations For versions 2.3 and earlier, consider restricting access to the calendar.php file until a fix is available. As a temporary workaround, avoid using the d parameter in the calendar.php file to minimize the risk of path disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2006-7062

Produtos afetados

Kamgaing Email System

Referências · 4

• http://pridels0.blogspot.com/2006/04/kmail-23-vuln.html · Nota
• http://osvdb.org/25065 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-7062 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26120 · Nota