20080815 Re: MicroWorld MailScan - Multiple Vulnerabilities within Admin-Webinterfacemailing list
http://marc.info/?l=bugtraq&m=121881329424635&w=2 CVE-2008-3727
Microworld Mailscan 5.6.a - Password Reveal
Record summary
CVE-2008-3727 has a selected CVSS score of 5.0; EIP currently links 1 catalogued exploit.
Description
Directory traversal vulnerability in Web Based Administration in MicroWorld Technologies MailScan 5.6.a espatch 1 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBMicroworld Mailscan 5.6.a - Password RevealExploitDB exploitby SlaYeRNot analyzed1 file
References
831534Third-party advisory
http://secunia.com/advisories/31534 4172Third-party advisory
http://securityreason.com/securityalert/4172 oliverkarow.de
http://www.oliverkarow.de/research/mailscan.txt 30700vdb entry
http://www.securityfocus.com/bid/30700 mailscan-admininterface-directory-traversal(44514)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/44514 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2008-3727 6407exploit
https://www.exploit-db.com/exploits/6407