CVE-2018-8741 A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate (or potentially delete) files from the hosting server, related to ../ in the att_local_name field in De...
HighCVSS 8.8
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate (or potentially delete) files from the hosting server, related to ../ in the att_local_name field in Deliver.class.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| squirrelmail | = 1.4.22 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
References
- www.openwall.com mailing-list third-party-advisory
- 1040554 third-party-advisory vdb-entry
- gist.github.com patch third-party-advisory
- insinuator.net patch third-party-advisory
- [debian-lts-announce] 20180416 [SECURITY] [DLA 1344-1] squirrelmail security update mailing-list third-party-advisory
- FEDORA-2019-ad02f64a79 vendor-advisory
- FEDORA-2019-1a87523729 vendor-advisory
- paste.pound-python.org third-party-advisory
- DSA-4168 third-party-advisory vendor-advisory