CVE-2015-1503 Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the file parameter to a webmail/client/skins/de...
HighCVSS 7.5
EPSS 57.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the file parameter to a webmail/client/skins/default/css/css.php page or .../. (dot dot dot slash dot) in the (2) script or (3) style parameter to webmail/old/calendar/minimizer/index.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| icewarp mail server | < 11.2.0 | 11.2.0 |
References
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 44587 exploit third-party-advisory vdb-entry
- www.trustwave.com exploit third-party-advisory