CVE-2008-0946

medium

Description

Directory traversal vulnerability in the IM Server (aka IMserve or IMserver) in Ipswitch Instant Messaging (IM) 2.0.8.1 and earlier allows remote authenticated users to create arbitrary empty files via a .. (dot dot) in the recipient field.

References

http://www.securityfocus.com/bid/27677

http://www.securityfocus.com/archive/1/487748/100/200/threaded

http://securityreason.com/securityalert/3697

Details

Source: Mitre, NVD

Published: 2008-02-25

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 4.9

Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N