PT-2003-1476 · Sl · Slwebmail+1

David Litchfield + 1 · Published 2003-05-08 · Updated 2016-10-18 · CVE-2003-0268

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SLWebMail version 3

Description: The issue allows remote attackers to identify the full path of the server via invalid requests to DLLs such as WebMailReq.dll. This is possible because the error message reveals the path when an invalid request is made.

Recommendations: For SLWebMail version 3, consider restricting access to the WebMailReq.dll until a patch is available to prevent the disclosure of the server's path.

Fix

Related Identifiers

CVE-2003-0268

Affected Products

Slwebmail

Webmailreq.Dll

References · 4

• http://nextgenss.com/advisories/slwebmail-vulns.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0268 · Security Note
• http://marc.info/?l=ntbugtraq&m=105233363721919&w=2 · Note
• http://marc.info/?l=bugtraq&m=105232436210273&w=2 · Note