CVE-2002-1385: High severity Open Webmail Open WebMail vulnerability

Published Dec 26, 2002

Updated

openwebmailinit in Open WebMail 1.81 and earlier allows local users to execute arbitrary code via .. (dot dot) sequences in a login name, such as the name provided in the sessionid parameter for openwebmail-abook.pl, which is used to find a configuration file that specifies additional code to be executed.

Affected Software

4 affected components

Open Webmail Open WebMail=1.7

Open Webmail Open WebMail=1.81

Open Webmail Open WebMail=1.71

Open Webmail Open WebMail=1.8

Remediation

Patch Available

http://sourceforge.net/forum/forum.php?thread_id=782605&forum_id=108435

Event History

Dec 26, 2002

CVE Published

05:00 AM

Sep 1, 2004

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2002-1385?

CVE-2002-1385 is considered a high severity vulnerability due to its potential to allow arbitrary code execution by local users.

How do I fix CVE-2002-1385?

The fix for CVE-2002-1385 involves upgrading to a later version of Open WebMail that addresses this vulnerability.

Who is affected by CVE-2002-1385?

CVE-2002-1385 affects local users of Open WebMail versions 1.7 through 1.81.

What type of vulnerability is CVE-2002-1385?

CVE-2002-1385 is a directory traversal vulnerability that allows unauthorized access to system files.

What conditions lead to CVE-2002-1385 exploitation?

Exploitation of CVE-2002-1385 occurs when malicious users provide specially crafted login names using dot dot sequences.