| Vulnerability Name: | CVE-2005-1252 (CCN-20719) | ||||||||
| Assigned: | 2005-05-24 | ||||||||
| Published: | 2005-05-24 | ||||||||
| Updated: | 2008-11-15 | ||||||||
| Summary: | Directory traversal vulnerability in the Web Calendaring server in Ipswitch Imail 8.13, and other versions before IMail Server 8.2 Hotfix 2, allows remote attackers to read arbitrary files via "..\" (dot dot backslash) sequences in the query string argument in a GET request to a non-existent .jsp file. | ||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
| ||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Obtain Information | ||||||||
| References: | Source: CCN Type: Ipswitch FTP Product Support Web page IMail Source: MITRE Type: CNA CVE-2005-1252 Source: CCN Type: SECTRACK ID: 1014047 IPswitch IMail Bugs Let Remote Users View Files and Execute Arbitrary Code Source: SECTRACK Type: UNKNOWN 1014047 Source: CCN Type: iDEFENSE Security Advisory 05.24.05 Ipswitch IMail Web Calendaring Arbitrary File Read Vulnerability Source: IDEFENSE Type: Vendor Advisory 20050524 Ipswitch IMail Web Calendaring Arbitrary File Read Vulnerability Source: CCN Type: Ipswitch Web site Welcome to Ipswitch Source: CCN Type: Ipswitch IMail Server 8.15 Hotfix 2 Support Source: CCN Type: Ipswitch IMail Server 8.2 Hotfix 2 Support Source: CONFIRM Type: Patch http://www.ipswitch.com/support/imail/releases/imail_professional/im82hf2.html Source: CCN Type: OSVDB ID: 16805 Ipswitch IMail Web Calendaring Server GET Request Traversal Arbitrary File Access Source: BID Type: UNKNOWN 13727 Source: CCN Type: BID-13727 Ipswitch IMail Server Multiple Vulnerabilities Source: XF Type: UNKNOWN imail-web-calendaring-information-disclosure(20719) | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| BACK | |||||||||