PT-2008-1855 · Uebimiau · Uebimiau Webmail

Eugene Minaev · Publicado 2008-01-10 · Atualizado 2017-09-29 · CVE-2008-0210

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Uebimiau Webmail versions 2.7.2 through 2.7.10

Description The issue allows remote attackers to bypass authentication by setting the sess[auth] parameter to 1 via HTTP requests, as the software does not protect authentication state variables. This can be used to conduct directory traversal attacks without authentication.

Recommendations For Uebimiau Webmail versions 2.7.2 through 2.7.10, avoid using the sess[auth] parameter in HTTP requests until the issue is resolved. As a temporary workaround, consider restricting access to sensitive areas of the webmail application to minimize the risk of exploitation.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-0210

Produtos afetados

Uebimiau Webmail

Referências · 4

• 🔥 https://exploit-db.com/exploits/4846 · Exploit
• 🔥 http://securityfocus.com/bid/27154 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0210 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0210 · Nota de Segurança