Nessus Plugin #14631

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

IlohaMail Arbitrary File Access via Session Variable Vulnerability

Family:

Remote file access

Category:

infos

Copyright:

This script is Copyright (C) 2004 George A. Theall

Summary:

Checks for Arbitrary File Access via Session Variable vulnerability in IlohaMail

Version:

$Revision: 1.1 $

Cve_id:

-

Bugtraq_id:

-

Xrefs:

OSVDB:7335

Description:

The target is running at least one instance of IlohaMail version
0.7.11 or earlier. Such versions contain a flaw in the processing of
the session variable that allows an unauthenticated attacker to
retrieve arbitrary files available to the web user, provided the
filesystem backend is in use.

Solution : Upgrade to IlohaMail version 0.7.12 or later.

Risk factor : Medium