Описание
The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Server but is ineffective with nginx. Attackers can read logs via the webmail/logs/sendmail URI.
Ссылки
- ExploitIssue TrackingThird Party Advisory
- Release NotesVendor Advisory
- ExploitIssue TrackingThird Party Advisory
- Release NotesVendor Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:analogic:poste.io:2.1.6:*:*:*:*:*:*:*
EPSS
Процентиль: 41%
0.00189
Низкий
4.3 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-693
Связанные уязвимости
CVSS3: 4.3
github
больше 3 лет назад
The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Server but is ineffective with nginx. Attackers can read logs via the webmail/logs/sendmail URI.
EPSS
Процентиль: 41%
0.00189
Низкий
4.3 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-693