CVE-2012-1919

AtMail Open-Source < 1.04 - Directory Traversal and Arbitrary File Read via CRLF Injection

Title source: llm
STIX 2.1

Description

CRLF injection vulnerability in mime.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to conduct directory traversal attacks and read arbitrary files via a %0A sequence followed by a .. (dot dot) in the file parameter.

References (4)

Core 4
Core References
Various Sources x_refsource_misc
http://en.securitylab.ru/lab/PT-2011-48
Patch x_refsource_confirm
http://atmail.org/download/atmailopen.tgz
US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/743555
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/47012

Scores

EPSS 0.0207
EPSS Percentile 79.1%

Details

CWE
CWE-94
Status published
Products (1)
atmail/atmail_open < 1.04
Published Mar 27, 2012
Tracked Since Feb 18, 2026