CVE-2010-5334

IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of IceWarp Mailserver and the operating system. Input passed via a certain parameter (_c to basic/index.html) is not properly sanitised and can therefore be exploited to browse the partition where IceWarp is installed (or the whole system) and read arbitrary files.

Score

CVSS 3.1 7.5 High

Status

Modified - cve@mitre.org

Published

2019-10-11

Last modified

2024-08-07

Weaknesses

CWE-22

Affected products

• Webclient (Icewarp)

References

• https://vuldb.com/?id.142994
• https://www.gosecurity.ch/fachartikel/168-gosecurity-advisory-2010120601