CVE-2013-5035

htmlcleaner < 2.6 - Authenticated Race Condition in Email Handling

Title source: llm
STIX 2.1

Description

Multiple race conditions in HtmlCleaner before 2.6, as used in Open-Xchange AppSuite 7.2.2 before rev13 and other products, allow remote authenticated users to read the private e-mail of other persons in opportunistic circumstances by leveraging lack of thread safety and performing a rapid series of (1) mail-sending or (2) draft-saving operations.

References (2)

Core 2
Core References
Exploit x_refsource_confirm
http://sourceforge.net/p/htmlcleaner/bugs/86/
Exploit mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2013-08/0115.html

Scores

EPSS 0.0013
EPSS Percentile 32.3%

Details

CWE
CWE-362
Status published
Products (20)
htmlcleaner_project/htmlcleaner 0.8
htmlcleaner_project/htmlcleaner 0.9
htmlcleaner_project/htmlcleaner 1.0
htmlcleaner_project/htmlcleaner 1.0.5
htmlcleaner_project/htmlcleaner 1.1
htmlcleaner_project/htmlcleaner 1.2
htmlcleaner_project/htmlcleaner 1.3
htmlcleaner_project/htmlcleaner 1.4
htmlcleaner_project/htmlcleaner 1.5
htmlcleaner_project/htmlcleaner 1.6
... and 10 more
Published Sep 05, 2013
Tracked Since Feb 18, 2026