PT-2009-1466 · Mailscanner · Mailwatch For Mailscanner

Dun · Published 2009-01-28 · Updated 2017-09-29 · CVE-2008-5991

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MailWatch for MailScanner version 1.0.4 and earlier

Description The issue allows remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the doc parameter of the docs.php file, enabling directory traversal.

Recommendations For MailWatch for MailScanner version 1.0.4 and earlier, consider restricting access to the docs.php file until a patch is available. As a temporary workaround, avoid using the doc parameter in the affected endpoint.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-5991

Affected Products

Mailwatch For Mailscanner

References · 5

• 🔥 http://securityfocus.com/bid/31378 · Exploit
• 🔥 https://exploit-db.com/exploits/6552 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5991 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45393 · Note
• http://secunia.com/advisories/31994 · Note