PT-2009-5515 · Uebimiau · Uebimiau Webmail

Septemb0X · Publicado 2009-09-15 · Atualizado 2017-09-19 · CVE-2009-3199

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Uebimiau Webmail version 3.2.0-2.0

Description The issue allows remote attackers to download a database containing usernames and password hashes by making a direct request for the "system admin/admin.ucf" file. This is possible due to insufficient access control over sensitive information stored under the web root.

Recommendations For Uebimiau Webmail version 3.2.0-2.0, consider restricting access to the "system admin/admin.ucf" file to prevent unauthorized downloads of the database. Additionally, review and improve access controls over sensitive information stored under the web root to prevent similar issues.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2009-3199

Produtos afetados

Uebimiau Webmail

Referências · 5

• 🔥 http://exploit-db.com/exploits/9493 · Exploit
• 🔥 https://exploit-db.com/exploits/9493 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52724 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3199 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-3199 · Nota de Segurança