CVE-2010-3486 Directory traversal vulnerability in FileStorageUpload.ashx in SmarterMail 7.1.3876 allows remote attackers to read arbitrary files via a (1) ../ (dot dot slash), (2) %5C (encoded backslash), or (3) %...
MediumCVSS 5.0
EPSS 3.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in FileStorageUpload.ashx in SmarterMail 7.1.3876 allows remote attackers to read arbitrary files via a (1) ../ (dot dot slash), (2) %5C (encoded backslash), or (3) %255c (double-encoded backslash) in the name parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Smartertools Smartermail | = 7.1.3876 | No fix listed |
References
- cloudscan.blogspot.com exploit
- packetstormsecurity.org exploit
- 15048 exploit
- 43324 vdb-entry
- smartermail-get-directory-traversal(61910) vdb-entry