CVE-2004-2458: Medium severity Open Webmail Open WebMail vulnerability
Published Dec 31, 2004
·Updated
Open WebMail 2.30 and earlier, when usesyshomedir is disabled or createsyshomedir is enabled, creates new directories before authenticating, which allows remote attackers to create arbitrary directories.
Affected Software
6 affected components
Open Webmail Open WebMail=1.7
Open Webmail Open WebMail=1.81
Open Webmail Open WebMail=2.30
Open Webmail Open WebMail=1.71
Open Webmail Open WebMail=1.8
Open Webmail Open WebMail=1.90
Remediation
Patch Available
Event History
Dec 31, 2004
CVE Published
05:00 AM
Aug 20, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-2458?
CVE-2004-2458 has a high severity rating due to the potential for remote attackers to create arbitrary directories.
2
How can I fix CVE-2004-2458?
To fix CVE-2004-2458, ensure that use_syshomedir is enabled and create_syshomedir is disabled.
3
What software is affected by CVE-2004-2458?
CVE-2004-2458 affects Open WebMail versions 1.7, 1.71, 1.8, 1.81, 1.90, and 2.30.
4
What type of attack is possible with CVE-2004-2458?
CVE-2004-2458 allows for unauthorized directory creation by remote attackers.
5
Is there a patch available for CVE-2004-2458?
Yes, patches have been made available for CVE-2004-2458 through the official Open WebMail website.