PT-2009-1466 · Mailscanner · Mailwatch For Mailscanner

Dun · Publicado 2009-01-28 · Atualizado 2017-09-29 · CVE-2008-5991

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MailWatch for MailScanner version 1.0.4 and earlier

Description The issue allows remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the doc parameter of the docs.php file, enabling directory traversal.

Recommendations For MailWatch for MailScanner version 1.0.4 and earlier, consider restricting access to the docs.php file until a patch is available. As a temporary workaround, avoid using the doc parameter in the affected endpoint.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-5991

Produtos afetados

Mailwatch For Mailscanner

Referências · 5

• 🔥 http://securityfocus.com/bid/31378 · Exploit
• 🔥 https://exploit-db.com/exploits/6552 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45393 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5991 · Nota de Segurança
• http://secunia.com/advisories/31994 · Nota