CVE-2006-2917

Directory traversal vulnerability in the IMAP server in WinGate 6.1.2.1094 and 6.1.3.1096, and possibly other versions before 6.1.4 Build 1099, allows remote authenticated users to read email of other users, or perform unauthorized operations on directories, via the (1) CREATE, (2) SELECT, (3) DELETE, (4) RENAME, (5) COPY, (6) APPEND, and (7) LIST commands.

CVSS v2.0 5.5 MEDIUM

5.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:N

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/20707	Patch Vendor Advisory
http://secunia.com/secunia_research/2006-48/advisory/	Vendor Advisory
http://www.securityfocus.com/bid/18908
http://www.vupen.com/english/advisories/2006/2730
http://www.wingate.com/download.php

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:qbik:wingate:6.1.2.1094:::::::*
	cpe:2.3:a:qbik:wingate:6.1.3.1096:::::::*

History

No history.

Information

Published : 2006-07-10 19:05

Updated : 2024-02-28 10:42

NVD link : CVE-2006-2917

Mitre link : CVE-2006-2917

CVE.ORG link : CVE-2006-2917

JSON object : View

Products Affected

qbik

wingate

CWE

NVD-CWE-Other

{"id": "CVE-2006-2917", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2006-07-10T19:05:00.000", "references": [{"url": "http://secunia.com/advisories/20707", "tags": ["Patch", "Vendor Advisory"], "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://secunia.com/secunia_research/2006-48/advisory/", "tags": ["Vendor Advisory"], "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://www.securityfocus.com/bid/18908", "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://www.vupen.com/english/advisories/2006/2730", "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://www.wingate.com/download.php", "source": "PSIRT-CNA@flexerasoftware.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in the IMAP server in WinGate 6.1.2.1094 and 6.1.3.1096, and possibly other versions before 6.1.4 Build 1099, allows remote authenticated users to read email of other users, or perform unauthorized operations on directories, via the (1) CREATE, (2) SELECT, (3) DELETE, (4) RENAME, (5) COPY, (6) APPEND, and (7) LIST commands."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en el servidor IMAP en WinGate 6.1.2.1094 y 6.1.3.1096, y posiblemente otras versiones anteriores a 6.1.4 Build 1099, permite a usuarios autenticados leer el correo de otros usuarios, o realizar operaciones no autorizadas en los directorios, a trav\u00e9s de las ordenes 1) CREATE, (2) SELECT, (3) DELETE, (4) RENAME, (5) COPY, (6) APPEND, y (7) LIST."}], "lastModified": "2011-03-08T02:37:17.893", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:qbik:wingate:6.1.2.1094:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "982DE691-B50E-49B2-B4DF-EC518DFFCE75"}, {"criteria": "cpe:2.3:a:qbik:wingate:6.1.3.1096:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F8EFCA3-2453-4272-9692-22598676DFC0"}], "operator": "OR"}]}], "sourceIdentifier": "PSIRT-CNA@flexerasoftware.com"}