CVE-2019-12938

2019-06-2413:07:31

mitre

www.cve.org

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

21.1%

JSON

The Roundcube component of Analogic Poste.io 2.1.6 uses .htaccess to protect the logs/ folder, which is effective with the Apache HTTP Server but is ineffective with nginx. Attackers can read logs via the webmail/logs/sendmail URI.

References

bitbucket.org/analogic/mailserver/issues/665/posteio-logs-leak

poste.io/changelog