CVE-2012-1917 - Vulnerability Details - OpenCVE

compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ (dot dot slash) sequences in the unique parameter, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ..././ (dot dot dot slash dot slash) sequence.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.01617.

Key SSVC decision points have not yet been added.

Vendors	Products
Atmail	Atmail Open

Configuration 1 [-]

cpe:2.3:a:atmail:atmail_open:*:*:open-source:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2012-1926	compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ (dot dot slash) sequences in the unique parameter, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ..././ (dot dot dot slash dot slash) sequence.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://atmail.org/download/atmailopen.tgz
http://en.securitylab.ru/lab/PT-2011-48
http://secunia.com/advisories/47012
http://www.kb.cert.org/vuls/id/743555

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2012-03-27T19:00:00

Updated: 2024-08-06T19:17:27.278Z

Reserved: 2012-03-27T00:00:00

Link: CVE-2012-1917

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2012-03-27T19:55:02.410

Modified: 2025-04-11T00:51:21.963

Link: CVE-2012-1917

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-03-26T00:00:00", "descriptions": [{"lang": "en", "value": "compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ (dot dot slash) sequences in the unique parameter, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ..././ (dot dot dot slash dot slash) sequence."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2012-08-28T09:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://en.securitylab.ru/lab/PT-2011-48"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://atmail.org/download/atmailopen.tgz"}, {"name": "VU#743555", "tags": ["third-party-advisory", "x_refsource_CERT-VN"], "url": "http://www.kb.cert.org/vuls/id/743555"}, {"name": "47012", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/47012"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2012-1917", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ (dot dot slash) sequences in the unique parameter, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ..././ (dot dot dot slash dot slash) sequence."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://en.securitylab.ru/lab/PT-2011-48", "refsource": "MISC", "url": "http://en.securitylab.ru/lab/PT-2011-48"}, {"name": "http://atmail.org/download/atmailopen.tgz", "refsource": "CONFIRM", "url": "http://atmail.org/download/atmailopen.tgz"}, {"name": "VU#743555", "refsource": "CERT-VN", "url": "http://www.kb.cert.org/vuls/id/743555"}, {"name": "47012", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/47012"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T19:17:27.278Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://en.securitylab.ru/lab/PT-2011-48"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://atmail.org/download/atmailopen.tgz"}, {"name": "VU#743555", "tags": ["third-party-advisory", "x_refsource_CERT-VN", "x_transferred"], "url": "http://www.kb.cert.org/vuls/id/743555"}, {"name": "47012", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/47012"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2012-1917", "datePublished": "2012-03-27T19:00:00", "dateReserved": "2012-03-27T00:00:00", "dateUpdated": "2024-08-06T19:17:27.278Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atmail:atmail_open:*:*:open-source:*:*:*:*:*", "matchCriteriaId": "7CB38DF5-0285-41D6-A69E-7BA178B4DEFC", "versionEndIncluding": "1.04", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ (dot dot slash) sequences in the unique parameter, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ..././ (dot dot dot slash dot slash) sequence."}, {"lang": "es", "value": "compose.php en @Mail WebMail Client en AtMail Open-Source antes de v1.05 no gestiona correctamente las secuencias ../ (punto punto barra) en el par\u00e1metro 'unique', lo que permite realizar ataques de salto de directorio y leer archivos de su elecci\u00f3n a atacantes remotos a trav\u00e9s de una secuencia ..././ (punto punto punto punto barra barra)."}], "id": "CVE-2012-1917", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2012-03-27T19:55:02.410", "references": [{"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://atmail.org/download/atmailopen.tgz"}, {"source": "cve@mitre.org", "url": "http://en.securitylab.ru/lab/PT-2011-48"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/47012"}, {"source": "cve@mitre.org", "tags": ["US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/743555"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://atmail.org/download/atmailopen.tgz"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://en.securitylab.ru/lab/PT-2011-48"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/47012"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/743555"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}