CVE-2002-2410

Open WebMail 1.7 and 1.71 - Information Exposure via Error Messages

Title source: llm

Description

openwebmail.pl in Open WebMail 1.7 and 1.71 reveals sensitive information in error messages and generates different responses whether a user exists or not, which allows remote attackers to identify valid usernames via brute force attacks and obtain certain configuration and version information.

References (3)

Core 3

Core References

Third Party Advisory vdb-entry x_refsource_xf

http://www.iss.net/security_center/static/10684.php

Exploit mailing-list x_refsource_bugtraq

http://archives.neohapsis.com/archives/bugtraq/2002-11/0278.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/6232

Scores

EPSS 0.0131

EPSS Percentile 67.2%

Details

CWE

CWE-200

Status published

Products (2)

open_webmail/open_webmail 1.7

open_webmail/open_webmail 1.71

Published Dec 31, 2002

Tracked Since Feb 18, 2026