PT-2008-6108 · U Mail · U-Mail Webmail Server

Shennan Wang · Publicado 2008-11-05 · Atualizado 2018-10-11 · CVE-2008-4932

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions U-Mail Webmail server version 4.91

Description The issue allows remote attackers to overwrite arbitrary files by providing an absolute pathname in the path parameter and arbitrary content in the content parameter in the webmail/modules/filesystem/edit.php file. This can be leveraged for code execution by writing to a file under the web document root.

Recommendations For U-Mail Webmail server version 4.91, restrict access to the webmail/modules/filesystem/edit.php file to minimize the risk of exploitation. Avoid using the path and content parameters in this file until the issue is resolved.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-4932

Produtos afetados

U-Mail Webmail Server

Referências · 7

• 🔥 https://exploit-db.com/exploits/6898 · Exploit
• 🔥 http://securityfocus.com/bid/32013 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4932 · Nota de Segurança
• http://securityfocus.com/archive/1/497961/100/0/threaded · Nota
• http://secunia.com/advisories/32540 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46300 · Nota
• http://securityreason.com/securityalert/4565 · Nota