PT-2009-5515 · Uebimiau · Uebimiau Webmail

Septemb0X · Published 2009-09-15 · Updated 2017-09-19 · CVE-2009-3199

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Uebimiau Webmail version 3.2.0-2.0

Description The issue allows remote attackers to download a database containing usernames and password hashes by making a direct request for the "system admin/admin.ucf" file. This is possible due to insufficient access control over sensitive information stored under the web root.

Recommendations For Uebimiau Webmail version 3.2.0-2.0, consider restricting access to the "system admin/admin.ucf" file to prevent unauthorized downloads of the database. Additionally, review and improve access controls over sensitive information stored under the web root to prevent similar issues.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2009-3199

Affected Products

Uebimiau Webmail

References · 5

• 🔥 http://exploit-db.com/exploits/9493 · Exploit
• 🔥 https://exploit-db.com/exploits/9493 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3199 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52724 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3199 · Note