CVE-2006-0818: Medium severity Deerfield Visnetic Mail Server vulnerability
Absolute path directory traversal vulnerability in (1) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (2) VisNetic MailServer before 8.5.0.5 allows remote authenticated users to include arbitrary files via a modified language parameter and a full Windows or UNC pathname in the langsettings parameter to mail/index.html, which is not properly sanitized by the validatefolder PHP function, possibly due to an incomplete fix for CVE-2005-4558.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-0818?
CVE-2006-0818 is classified as a medium severity vulnerability due to its potential for unauthorized file inclusion.
Who is affected by CVE-2006-0818?
CVE-2006-0818 affects the Merak Mail Server version 8.3.8r, VisNetic MailServer versions prior to 8.5.0.5, and IceWarp Web Mail version 5.6.0.
How do I fix CVE-2006-0818?
To fix CVE-2006-0818, update the affected software to the latest version that resolves this vulnerability.
What type of vulnerability is CVE-2006-0818?
CVE-2006-0818 is an absolute path directory traversal vulnerability allowing file inclusion via manipulated parameters.
Can CVE-2006-0818 be exploited remotely?
Yes, CVE-2006-0818 can be exploited remotely by authenticated users to include arbitrary files.