CVE-2019-12938

The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Server but is ineffective with nginx. Attackers can read logs via the webmail/logs/sendmail URI.

Score

CVSS 3.0 4.3 Medium

Status

Modified - cve@mitre.org

Published

2019-06-24

Last modified

2024-08-04

Weaknesses

CWE-693

Affected products

• Poste.io (Analogic)

References

• https://bitbucket.org/analogic/mailserver/issues/665/posteio-logs-leak
• https://poste.io/changelog