3.6 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:P/A:N
6.8 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
5.1%
The remote web server contains a PHP script that is prone to information
disclosure.
Description :
The remote host appears to be running a BasiliX version 1.1.0 or lower. Such versions allow retrieval of arbitrary
files that are accessible to the web server user when sending a message since they accept a list of attachment
names from the client yet do not verify that the attachments were in fact uploaded.
Further, since these versions do not sanitize input to the
# SPDX-FileCopyrightText: 2004 George A. Theall
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only
CPE = "cpe:/a:basilix:basilix_webmail";
if (description) {
script_oid("1.3.6.1.4.1.25623.1.0.14305");
script_version("2023-08-01T13:29:10+0000");
script_tag(name:"last_modification", value:"2023-08-01 13:29:10 +0000 (Tue, 01 Aug 2023)");
script_tag(name:"creation_date", value:"2005-11-03 14:08:04 +0100 (Thu, 03 Nov 2005)");
script_tag(name:"cvss_base", value:"3.6");
script_tag(name:"cvss_base_vector", value:"AV:L/AC:L/Au:N/C:P/I:P/A:N");
script_cve_id("CVE-2002-1710");
script_name("BasiliX Arbitrary File Disclosure Vulnerability");
script_category(ACT_GATHER_INFO);
script_tag(name:"qod_type", value:"remote_banner");
script_family("Web application abuses");
script_copyright("Copyright (C) 2004 George A. Theall");
script_dependencies("basilix_detect.nasl");
script_mandatory_keys("basilix/installed");
script_tag(name:"solution_type", value:"VendorFix");
script_tag(name:"solution", value:"Upgrade to BasiliX version 1.1.1 or later.");
script_tag(name:"summary", value:"The remote web server contains a PHP script that is prone to information
disclosure.
Description :
The remote host appears to be running a BasiliX version 1.1.0 or lower. Such versions allow retrieval of arbitrary
files that are accessible to the web server user when sending a message since they accept a list of attachment
names from the client yet do not verify that the attachments were in fact uploaded.
Further, since these versions do not sanitize input to the 'login.php3' script, it's possible for an attacker to
establish a session on the target without otherwise having access there by authenticating against an IMAP server
of his or her choosing.");
script_xref(name:"URL", value:"http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0113.html");
script_xref(name:"URL", value:"http://www.securityfocus.com/bid/5062");
exit(0);
}
include("host_details.inc");
include("version_func.inc");
if (!port = get_app_port(cpe: CPE))
exit(0);
if (!version = get_app_version(cpe: CPE, port: port))
exit(0);
if (version_is_less(version: version, test_version: "1.1.1")) {
report = report_fixed_ver(installed_version: version, fixed_version: "1.1.1");
security_message(port: port, data: report);
exit(0);
}
exit(99);