Back to search
CVE-2012-1917
Published: Mar 27, 2012
Modified: Aug 6, 2024
PUBLISHED
Description
compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ (dot dot slash) sequences in the unique parameter, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ..././ (dot dot dot slash dot slash) sequence.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
http://en.securitylab.ru/lab/PT-2011-48
x_refsource_MISC
http://atmail.org/download/atmailopen.tgz
x_refsource_CONFIRM
VU#743555
third-party-advisory
x_refsource_CERT-VN
47012
third-party-advisory
x_refsource_SECUNIA
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now