Back to Database
Status published
Medium
CVE-2012-1917
compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05...
Vulnerability Description
compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ (dot dot slash) sequences in the unique parameter, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ..././ (dot dot dot slash dot slash) sequence.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2012-1917
Credits & Attribution
No credits recorded in the NVD database.
References
More from atmail
View All →CVE-2022-31200
Atmail 5.62 allows XSS via the mail/parse.php?file=html/$this-%3ELanguage/help/filexp.html&FirstLoad=1&HelpFile=file.html Search Terms field....
Medium
6.1
CVE-2022-30776
atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter....
Medium
6.1
CVE-2021-43574
WebAdmin Control Panel in Atmail 6.5.0 (a version released in...
Medium
6.1
CVE-2017-9519
atmail before 7.8.0.2 has CSRF, allowing an attacker to create...
High
8.8
CVE-2017-9518
atmail before 7.8.0.2 has CSRF, allowing an attacker to change...
High
8.8
Affected Vendor
atmail
View all reports →Affected Software
atmail open
Vulnerable Versions:
0
Timeline
Official Publish:
March 27th, 2012
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.