CVE-2011-3580: Infoleak
Published Sep 30, 2011
·Updated
IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to obtain configuration information via a direct request to the /server URI, which triggers a call to the phpinfo function.
Affected Software
20 affected components
IceWarp Mail Server<=10.3.2
IceWarp Mail Server=9.3.0
IceWarp Mail Server=9.3.1
IceWarp Mail Server=9.3.2
IceWarp Mail Server=9.4.0
IceWarp Mail Server=9.4.1
IceWarp Mail Server=9.4.2
IceWarp Mail Server=10.0.3
IceWarp Mail Server=10.0.4
IceWarp Mail Server=10.0.7
IceWarp Mail Server=10.0.8
IceWarp Mail Server=10.1.1
IceWarp Mail Server=10.1.2
IceWarp Mail Server=10.1.3
IceWarp Mail Server=10.1.4
IceWarp Mail Server=10.2.0
IceWarp Mail Server=10.2.1
IceWarp Mail Server=10.2.2
IceWarp Mail Server=10.3.0
IceWarp Mail Server=10.3.1
Event History
Sep 30, 2011
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-3580?
CVE-2011-3580 has a medium severity rating due to the exposure of sensitive configuration information.
2
How do I fix CVE-2011-3580?
To fix CVE-2011-3580, upgrade IceWarp Mail Server to version 10.3.3 or later, which resolves this issue.
3
What versions of IceWarp Mail Server are affected by CVE-2011-3580?
CVE-2011-3580 affects IceWarp Mail Server versions from 9.3.0 to 10.3.2.
4
What could be the impact of exploiting CVE-2011-3580?
Exploiting CVE-2011-3580 may allow remote attackers to gain access to sensitive configuration information from the server.
5
Is there a workaround for CVE-2011-3580?
There are no documented workarounds for CVE-2011-3580, so updating to a secure version is recommended.