CVE-2017-9846 Winmail Server 6.1 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php move_folder_file call to move a .php file from the FTP folder into a web folder...
HighCVSS 8.8
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Winmail Server 6.1 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php move_folder_file call to move a .php file from the FTP folder into a web folder.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| magicwinmail winmail server | = 6.1 | No fix listed |
References
- www.magicwinmail.com release-notes vendor-advisory
- github.com issue-tracking patch third-party-advisory