PT-2008-1855 · Uebimiau · Uebimiau Webmail

Eugene Minaev · Published 2008-01-10 · Updated 2017-09-29 · CVE-2008-0210

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Uebimiau Webmail versions 2.7.2 through 2.7.10

Description The issue allows remote attackers to bypass authentication by setting the sess[auth] parameter to 1 via HTTP requests, as the software does not protect authentication state variables. This can be used to conduct directory traversal attacks without authentication.

Recommendations For Uebimiau Webmail versions 2.7.2 through 2.7.10, avoid using the sess[auth] parameter in HTTP requests until the issue is resolved. As a temporary workaround, consider restricting access to sensitive areas of the webmail application to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-0210

Affected Products

Uebimiau Webmail

References · 4

• 🔥 https://exploit-db.com/exploits/4846 · Exploit
• 🔥 http://securityfocus.com/bid/27154 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0210 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0210 · Note