PT-2007-1341 · Kamgaing · Kamgaing Email System

Published 2007-02-24 · Updated 2017-07-29 · CVE-2006-7062

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kamgaing Email System (kmail) versions 2.3 and earlier

Description The issue allows remote attackers to obtain the full path of the server via an invalid d parameter in the calendar.php file, which leaks the path in an error message.

Recommendations For versions 2.3 and earlier, consider restricting access to the calendar.php file until a fix is available. As a temporary workaround, avoid using the d parameter in the calendar.php file to minimize the risk of path disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-7062

Affected Products

Kamgaing Email System

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2006-7062 · Security Note
• http://pridels0.blogspot.com/2006/04/kmail-23-vuln.html · Note
• http://osvdb.org/25065 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26120 · Note