Directory traversal

2018-03-1501:29:00

PRIOn knowledge base

www.prio-n.com

6.6 Medium

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

77.9%

JSON

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via a … (dot dot) in the option2 parameter in an attachment action to secmail/getmessage.exe.

CPENameOperatorVersion
securmaillt9.2.501

CPE	Name	Operator	Version
	securmail	lt	9.2.501

References

seclists.org/fulldisclosure/2018/Mar/29

www.exploit-db.com/exploits/44285/

www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-securenvoy-securmail/index.html