Cyclonic Webmail Information Disclosure Vulnerability
BID:9200
Info
Cyclonic Webmail Information Disclosure Vulnerability
| Bugtraq ID: | 9200 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 11 2003 12:00AM |
| Updated: | Dec 11 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to "Somers Raf" <[email protected]>. |
| Vulnerable: |
STALLION Networking Cyclonic webmail 4.0 |
| Not Vulnerable: | |
Discussion
Cyclonic Webmail Information Disclosure Vulnerability
Cyclonic webmail has been reported prone to an information disclosure vulnerability. It has been reported that user data is stored in the /users/ folder. When a user views an email with the Cyclonic webmail interface, the content of the email and any attachments of the email is stored in an insecure location. This procedure may result in the contents of the insecure directory being exposed to the public, via web requests, allowing a malicious attacker to potentially request and view sensitive email content.
Cyclonic webmail has been reported prone to an information disclosure vulnerability. It has been reported that user data is stored in the /users/ folder. When a user views an email with the Cyclonic webmail interface, the content of the email and any attachments of the email is stored in an insecure location. This procedure may result in the contents of the insecure directory being exposed to the public, via web requests, allowing a malicious attacker to potentially request and view sensitive email content.
Exploit / POC
Cyclonic Webmail Information Disclosure Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Cyclonic Webmail Information Disclosure Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Cyclonic Webmail Information Disclosure Vulnerability
References:
References:
- Cyclonic Webmail 4 multiple vulnerabilities ("Somers Raf"