Risk | Medium |
Patch available | NO |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2018-8741 |
CWE-ID | CWE-22 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
SquirrelMail Web applications / Webmail solutions |
Vendor | SquirrelMail Development Team |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU11169
Risk: Medium
CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N/E:U/RL:U/RC:C]
CVE-ID: CVE-2018-8741
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote authenticated attacker to obtain potentially sensitive information on the target system.
The weakness exists due to input validation flaw in 'Deliver.class.php'. A remote attacker can upload a file with a specially crafted filename containing directory traversal characters (e.g., '../'), cause the system to attach arbitrary files to an email message with the privileges of the target PHP process and obtain or delete arbitrary files with the privileges of the target PHP process.
Cybersecurity Help is currently unaware of any solutions addressing the vulnerability.
Vulnerable software versionsSquirrelMail: 1.4.22
External linkshttp://insinuator.net/2018/03/squirrelmail-full-disclosure-troopers18/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.