Detections
Analytics
IceWarp Web Mail Multiple Flaws (4)
high Nessus Plugin ID 19784
Language:
Synopsis
It is possible to retrieve/delete local files on the remote system through the webmail service.Description
The remote host is running IceWarp Web Mail - a webmail solution available for the Microsoft Windows platform.The remote version of this software is affected by a directory traversal vulnerability that may allow an attacker to retrieve arbitrary files on the system.
Another input validation flaw allows an attacker to delete arbitrary files on the remote host.
Note this flaw indicates IceWarp is vulnerable to cross-site scripting attacks too.
Solution
Unknown at this time.See Also
Plugin Details
Severity: High
ID: 19784
File Name: icewarp_webmail_vulns4.nasl
Version: 1.21
Type: remote
Family: CGI abuses
Published: 9/30/2005
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: High
Base Score: 9.7
Temporal Score: 9.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:P/A:C
Vulnerability Information
CPE: cpe:/a:icewarp:webmail
Exploit Available: true
Exploit Ease: No exploit is required
Exploited by Nessus: true
Vulnerability Publication Date: 9/30/2005