CVE-2005-1252
Directory traversal vulnerability in the Web Calendaring server in Ipswitch Imail 8.13, and other versions before IMail Server 8.2 Hotfix 2, allows remote attackers to read arbitrary files via "..\" (dot dot backslash) sequences in the query string…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 12.5%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
Directory traversal vulnerability in the Web Calendaring server in Ipswitch Imail 8.13, and other versions before IMail Server 8.2 Hotfix 2, allows remote attackers to read arbitrary files via "..\" (dot dot backslash) sequences in the query string argument in a GET request to a non-existent .jsp file.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 12.50% probability · 96th percentile
- CISA KEV
- Not listed
- Affected
- ipswitch/imail · ipswitch/imail server
- Source
- cve@mitre.org
References
- http://securitytracker.com/id?1014047
- http://www.idefense.com/application/poi/display?id=242&type=vulnerabilitiesVendor Advisory
- http://www.ipswitch.com/support/imail/releases/imail_professional/im82hf2.htmlPatch
- http://www.securityfocus.com/bid/13727
- http://securitytracker.com/id?1014047
- http://www.idefense.com/application/poi/display?id=242&type=vulnerabilitiesVendor Advisory
- http://www.ipswitch.com/support/imail/releases/imail_professional/im82hf2.htmlPatch
- http://www.securityfocus.com/bid/13727
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.