PT-2008-4489 · V Webmail · V-Webmail

Published 2008-10-07 · Updated 2017-08-08 · CVE-2008-3060

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: V-webmail version 1.5.0

Description: The issue allows remote attackers to obtain sensitive information. This can be achieved through malformed input in the login page, which includes the local.hooks.php file, or by using an invalid session ID. The latter reveals the installation path in an error message.

Recommendations: For V-webmail version 1.5.0, consider validating and sanitizing all user input to prevent malformed data from being processed, and implement proper error handling to avoid revealing sensitive information such as the installation path. Additionally, restrict access to error messages that could disclose sensitive details.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-3060

Affected Products

V-Webmail

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2008-3060 · Security Note
• http://osvdb.org/48793 · Note
• http://osvdb.org/ref/48/48-v-webmail.txt · Note
• http://osvdb.org/48794 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45853 · Note